SPIFFE
Secure Production Identity Framework For Everyone
Secure Production Identity Framework For Everyone, a CNCF standard for workload identity. Each workload receives a SPIFFE ID (spiffe://trust-domain/path) in a short-lived X.509 or JWT SVID from a Workload API, such as SPIRE’s, so services can authenticate each other without long-lived secrets.
- Defined in
- SPIFFE overview
Covered in
Guide
Workload identity federation: short-lived, scoped identities for services and CI
Trace how a running workload obtains a short-lived identity, write cloud trust policies that match immutable claims instead of names or wildcards, and keep the resulting credential limited by audience and authorization.
Guide
Authenticate workloads and authorize their service actions
Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.