What is SPIRE?
SPIRE (SPIFFE Runtime Environment) is the reference implementation of the SPIFFE specification. It is a CNCF graduated project used by Bloomberg, Uber, Pinterest, and ByteDance at massive scale.
SPIRE Architecture
- SPIRE Server: Central control plane that manages registrations, signs SVIDs, and maintains the trust bundle. Runs as a Kubernetes StatefulSet.
- SPIRE Agent: Runs on every node (DaemonSet). Exposes the Workload API, performs workload attestation, and caches SVIDs.
- Controller Manager: Watches Kubernetes for pod events and auto-registers workloads.
How SPIRE Issues Identity
- Agent starts on a node and proves its legitimacy to the Server (node attestation)
- A workload calls the Workload API via Unix domain socket
- Agent inspects the calling process and matches it to a registration entry (workload attestation)
- Agent requests an SVID from the Server and returns it to the workload
- SVID is automatically rotated before expiry — zero manual intervention
Learn SPIRE
Deploy SPIRE on Kubernetes in our free Module 5: Running SPIRE on Kubernetes.