CodersSecret

Course guide

SPIRE on Kubernetes: Step-by-Step Deployment Tutorial

Deploy SPIRE Server and Agent on Kubernetes, register workloads, and secure pod-to-pod communication with mTLS. Complete hands-on tutorial with manifests.

This tutorial walks through deploying SPIRE on a Kubernetes cluster, registering workloads, and verifying that pods receive cryptographic identities. By the end, your pods will have automatically-issued, short-lived X.509 certificates for mutual TLS.

Prerequisites

  • A Kubernetes cluster (Kind, Minikube, or cloud-managed)
  • kubectl configured and working
  • Basic understanding of Kubernetes pods, services, and service accounts

Architecture Overview

SPIRE runs as two components on Kubernetes: the SPIRE Server (a StatefulSet with persistent storage for the datastore) and the SPIRE Agent (a DaemonSet that runs on every node). The Agent exposes the SPIFFE Workload API via a Unix domain socket that pods access through a CSI driver or hostPath volume.

What You Will Deploy

  1. SPIRE Server as a StatefulSet with SQLite datastore
  2. SPIRE Agent as a DaemonSet with Kubernetes node attestor
  3. SPIRE Controller Manager for automatic workload registration
  4. A demo application that retrieves its SVID and establishes mTLS

Full Tutorial in Our Free Course

Module 5 of the Mastering SPIFFE & SPIRE course provides the complete hands-on tutorial with Kubernetes manifests, verification commands, and troubleshooting guides. The companion GitHub repository contains all manifests ready to apply.

Learning path

Continue from concept to implementation

These course modules place this topic in context, connect it to adjacent decisions, and provide the practical next step.

Module 4

SPIRE Architecture and Components

How SPIRE implements the SPIFFE specification in production

3.5 hours | 4 learning objectives

Module 5

Running SPIRE on Kubernetes

Deploy and operate SPIRE in real Kubernetes clusters

4 hours | 4 learning objectives

Module 6

Working with SVIDs and the Workload API

How applications consume and use SPIFFE identities

3 hours | 4 learning objectives

Practical outcomes

What the recommended module teaches

  • Deploy SPIRE Server and Agent on Kubernetes
  • Configure Kubernetes workload and node attestors
  • Use SPIRE Controller Manager for automatic registration
  • Retrieve SVIDs inside pods