SPIFFE
Secure Production Identity Framework for Everyone. A CNCF-graduated specification for workload identity. SPIFFE IDs are URI-like identifiers; SVIDs are the cryptographic credentials (x509 or JWT) that prove a workload owns its ID.
SPIFFE matters because it gives workloads an identity the platform attests, rather than a secret someone provisioned, which removes the credential from the threat model entirely. The identity is derived from where and what the workload is, and the SVID is short-lived by design. It is the cleanest available answer to service-to-service authentication in Kubernetes and multi-cloud estates.
See also: workload identity, mTLS, what is machine identity, machine identity vendors
Related on Start with Identity
- GlossaryNon-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most
- GlossaryAnonCreds
A verifiable credential format, originating in Hyperledger Indy and now a standalone specification, built around zero-knowledge proofs for strong selective disc
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- VendorSPIFFE / SPIRE
top_tier
- Comparisonspiffe-spire-vs-hashicorp-vault
SPIFFE and SPIRE answer who a workload is. HashiCorp Vault answers what it may hold. They overlap enough to compare and differ enough that many teams run both.