SPIFFE
Secure Production Identity Framework for Everyone. A CNCF-graduated specification for workload identity. SPIFFE IDs are URI-like identifiers; SVIDs are the cryptographic credentials (x509 or JWT) that prove a workload owns its ID.
SPIFFE matters because it gives workloads an identity the platform attests, rather than a secret someone provisioned, which removes the credential from the threat model entirely. The identity is derived from where and what the workload is, and the SVID is short-lived by design. It is the cleanest available answer to service-to-service authentication in Kubernetes and multi-cloud estates.
See also: workload identity, mTLS, what is machine identity, machine identity vendors, WIMSE
Related on Start with Identity
- GlossaryInstance Metadata Service (IMDS)
The instance metadata service (IMDS) is an HTTP endpoint reachable only from inside a cloud virtual machine, at 169.254.169.254 on AWS EC2, that returns data ab
- GlossaryMachine Identity
A machine identity is the credential that lets a device, server, application or workload prove who it is to another system without a person signing in: most oft
- GlossaryMicrosegmentation
Microsegmentation is a network control that divides an environment into small zones and allows only the connections policy explicitly permits between them, so a
- VendorSPIFFE / SPIRE
top_tier
- ExpertSPIFFE and SPIRE maintainer, co-author of Zero Trust Networks
Evan Gilman is a maintainer of SPIRE, the reference implementation of SPIFFE, and co-wrote O'Reilly's Zero Trust Networks. He was an engineer at Scytale, where
- Comparisonspiffe-spire-vs-hashicorp-vault
SPIFFE and SPIRE answer who a workload is. HashiCorp Vault answers what it may hold. They overlap enough to compare and differ enough that many teams run both.