►
From YouTube: Real World SPIFFE Scenarios and Outcomes - Andres Vega & Frederick Kautz, SPIFFE Steering Committee
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Real World SPIFFE Scenarios and Outcomes - Andres Vega & Frederick Kautz, SPIFFE Steering Committee
SPIFFE aims to strengthen the identification of software components in a common way that can be leveraged across distributed systems by anyone, anywhere. The ability to maintain software security by standardizing how systems define, attest, and maintain software identity, regardless of where systems are deployed or who deploys those systems, confers many benefits. The use of SPIFFE can significantly reduce costs associated with the overhead of managing and issuing cryptographic identity documents and accelerate development by removing the need for developers to understand the complexity involved to secure service-to-service communication, but that is not the only outcome. Production identity can have a positive impact on many areas such as interoperability, compliance, audibility, and more. This presentation demonstrates the real world scenarios and outcomes of deploying SPIFFE across your infrastructure and also using it to bridge and integrate the infrastructure of others.
A
A
A
B
Well,
so
with
that,
one
of
the
things
that
we
want
to
try
to
cover
are
real
world
spiffy
scenarios
and
outcomes,
and
so
we've
had
the
opportunity,
over
the
past
few
years
to
be
involved
with
with
several
colleagues
of
ours
and
trying
to
work
out
a
a
path
towards
like
what
works.
What
doesn't
work
and
try
to
work
out?
What
those
use
cases
are
so
part
of
our
hope
is
to
be
able
to
give
you
some
of
this
information
on
some
of
our
experiences
that
may
help
you
along
the
way.
A
So
if
you
go
check
the
rfc
for
the
internet
growth
you're,
going
to
find
many
considerations,
but
one
that's
not
present
is
security.
I
screenshot
it
all
that
they
covered.
This
is
the
one
line
from
there
on
we're
at
a
point
in
history
where,
like
software
not
only
runs
on
individual
servers,
they're
very
likely
managed
by
a
cloud
provider,
it's
likely
given
european
mandates
that
you're
not
only
doing
multi-cloud
you're
doing
many
multi-clouds
and
that
you're
trying
to
address
cross-authentication
issues.
B
B
Many
of
the
assumptions
that
we've
had
today
are
very
different
from
the
assumptions
that
we
had
five
years
ago
10
years
ago
20
years
ago,
so
one
of
the
realities
about
most
computer
systems
that
are
run
by
by
companies
is
that,
whatever,
whenever
they
first
develop,
their
computer
system
is
what
they're
native.
As
so.
If
you
develop
your
computer
system,
when
mainframes
were
the
thing,
then
the
only
the
only
native
system
that
you
have
is
probably
gonna
be
mainframe
native
you're
playing
catch-up
with
everything
with
every
everything
else
from
from
then
on.
B
So
when
we
start
looking
at
trust,
we
have
those
changes
of
assumptions
over
time
and
those
changes
in
assumption,
like
going
from
like
like
on-premise
to
like
cloud
as
an
example
like
what
is
changing
those
and
trying
to
develop
and
maintain.
That
trust
is,
is
important
to
to
look
at
those
assumptions
and
to
realize
what
has
changed
and
what
has
not
changed.
A
Yeah
with
that,
another
observation
was
well,
we
know
there's
going
to
be
vulnerabilities
and
software,
but
well
we'll
just
tackle
them
as
as
they
come
like
we'll.
Have
them
like
a
fly,
but
it's
more
like
trying
to
be
a
beekeeper
of
like
a
massive
honey
production
property
on
average,
the
national
vulnerability
database
reports
more
than
15
000
new
software
vulnerabilities.
A
So
it
is
a
given
that
you're
going
to
be
struggling
to
just
making
sure
it
doesn't
get
compromised,
which
begs
for
for
novel
approaches
with
that
is
not.
We
can't
trust
the
software.
We
can't
trust
the
people
either
like
we
all
like.
While
we
have
capacity
to
reason
we
all
our
decisions
are
often
like
emotional,
also
right
people
make
mistakes.
There's
human
error,
people
also
get
upset
and
those
individuals
may
have
access
to
every
single
high
value
asset
within
your
organization.
A
There
are
10
of
thousands
of
success
of
successful
attacks
and
breaches
that
have
a
common
denominator
of
either
phishing
or
an
exfiltrated
credential.
So
that's
another
thing
to
keep
an
eye
out
for,
but
well
we're
looking
at
the
landscape,
sure
there's
multiple
platforms,
multiple
cloud
boundaries
and
it's
just
like
we
can't
longer
just
put
in
walls,
because
people
may
within
good
intentions
like
in
order
to
conduct
your
jobs.
We
may
be
accessing
resources
across
boundaries,
and
this
these
are
legitimate.
B
Yeah,
so
so
part
of
it
is
that,
as
we
start
to
move
towards
the
new
environments,
there's
a
couple
trends
that
we're
starting
to
see.
So
some
of
the
trends
include
we're
expecting
more
more
development
to
occur
in
shorter
time
frames
like
people
are
saying:
oh
there's
a
lot
more
newer
technologies
coming
out,
so
we
want
to
be
able
to
ship
faster
scale
faster
and
simultaneously,
while
this
is
happening,
we're
also
looking
at
an
increased
level
of
communication
between
different
different
environments,
different
systems.
So
it's
no
longer
one.
B
Because
of
these
changes
that
have
occurred,
so
we
have
to
start
looking
at
how
do
we
actually
drive
this
towards
something?
That's
much
more
fine-grained
that
if
there's
a
if
there's
a
breach
that
occurs,
that
the
reward
from
that
breach
is
is
reduced
because
the
architecture
of
the
systems,
the
applications
themselves
have
been
designed
specifically
to
limit
and
not
not
trust,
fully
the
systems
that
they
connect
to,
but
instead
are
looking
at
okay.
What
am
I
talking
to?
B
What
am
I
allowed
to
communicate
to
them
and
and
to
also
work
not
only
to
have
this
fine
grain,
but
also
to
do
so
in
a
very
dynamic
environment,
because
it's
no
longer
an
environment
where
you
sit
down
and
program
access
control
lists,
and
then
they
last
there
for
several
years.
We're
getting
to
the
point
now
where
we
have
to
be
able
to
make
on-demand
decisions
for
every
request
and
in
order
to
in
in
order
to
handle
the
the
changes
that
we're
that
we're
seeing
within
the
industry.
A
And
and
the
ones
in
the
audience
that
are
engineers,
application
developers,
you
know,
there's
a
trend
of
you're,
not
only
being
asked
with
the
business
logic,
you're,
also
being
asked
with
the
availability,
the
performance
and
there's
the
current
trend
around
devsecops,
where
we're
also
expecting
to
shift
security
left.
So
all
these
little
people
trying
to
wrangle
things
like
you
could
be
all
of
these
folks
or
this
could
be
the
different
people
in
your
organization,
but
we
are
not
keeping
up
we're
barely
treading
water.
A
You
need
to
prove
by
a
possession
or
recognition
technology
who
you
are
so
how
and
does
massively
large
infrastructure.
Can
we
tell
with
certainty
something
we've
never
seen
before
if
it's
rogue
or
if
it's
legit,
and
how
do
we
transition
to
evaluate
and
say
well,
this
is
something
I've
never
seen
before.
Therefore,
should
have
no
access
to.
A
This
is
something
that
I
know
very
well
and
therefore
here
it's
here
are
its
keys,
but
when
we
issue
those
keys
or
we
use
secrets
management
and
we
map
policies
to
say
this
workload
will
have
access
to
the
secret.
We
start
encountering
a
problem
of
infinite
regression,
which
is
for
every
secret,
like
vault,
is
great
other,
like
secret
stores,
are
awesome
until
you
have
to
prove
to
them
who
you
are
because
then
you
need
another
secret.
It's
a
problem
of
secure
introduction.
How
do
we
do
that
and
for
that
secret?
A
B
Also,
don't
forget
as
well
that
the
moment
you
have
to
rotate
some
of
these
keys
because
one
of
them
is
compromised,
then
you
may
not
even
know
where
all
the
keys
are
that
you
have
to
go
off
in
and
rotate
and
so
you're
left.
With
this
option
of,
do
you
rotate
the
key
and
cause
possible
downtime?
If
you
don't
have
that
good,
that
good
tracking
or
do
you
end
up
rotating
and
bring
possibly
bring
down
certain
certain
system
as
a
result
of
that?
A
So
enters
spiffy
and
spiffy
starts
with
a
man.
Many
of
you
have
might
come
across
this
week
or
know
his
accomplishments
and
what
he
has
done
to
like
modernize
infrastructure
and
development
platforms.
Joe
bida,
one
of
the
co-creators
of
kubernetes
at
google,
having
left,
google
and
figuring
out
what
he
wanted
to
work
next,
he
evaluated
what
other
systems
existed
at
google
that
could
follow
the
same
pattern
as
kubernetes
of
let's
externalize.
A
It
make
it
a
an
abstraction
for
everyone
else
and
open
source
it,
and
he
stumbled
upon
a
system
at
google
called
the
low
overhead
authentication
system.
A
deep
dive
of
that
is
outside
of
the
scope
but
joe
presented
a
great
talk,
who's,
calling
if
a
service
comes
up.
How
do
I
know
what
it
is
if
like
we're,
looking
at
things
with
ip
addresses
or
certificates,
but
the
certificates
have
been
reused
reshared.
A
This
kicked
off
a
movement
and
convened
people
from
large
organizations
that
have
solved
the
problem
for
themselves
but
understood
the
value
prop
of
doing
it
in
the
community
doing
it
openly
and
gathering
at
the
netflix
office.
Individuals
from
netflix
facebook
and
google
proposed
what
were
the
key
attributes
and
virtues
if
we're
going
to
build
a
universal
pki
that
is
fully
automated
high
velocity.
A
A
A
We've
also
seen
it
deployed
by
very
large
organizations
that
we've
come
to
rely
on.
We
rely
on
github
for
our
jobs.
Some
individuals
may
like
tick-tock
from
bite
dance.
If
you
use
square
payments
or
if
you
hail
a
car
with
uber
all
of
their
services.
All
their
interactions
between
the
micro
services
that
make
up
their
applications
are
especially
protected.
A
B
Yeah
so
part
of
so
part
of
it
is
when
we
start
looking
at
where
company
from
a
company
perspective
like
we,
we
have.
We
have
some
good
examples
of
of
other
of
other
problems
that
that
mirror
are
so,
for
example.
Historically,
if
you
look
at
application,
develop
applications
and
users,
they
were
very
much
centric
to
the
application.
Every
application
maintain
their
own
database.
We're
sort
of
in
this
position
today
with
with
kubernetes,
where
every
kubernetes
cluster
keeps
track
of
its
own
workloads
and
it's
very
isolated
to
the
to
those
particular
environments.
B
Over
time
we
worked
out
okay.
Well,
we
can.
We
can
extract
that
out
into
its
own
identity
provider
for
those
users,
and
at
that
point
you
can
get
single
sign-on
across
system.
So,
if
you
think
about
spiffy
provides
a
set
of
standards,
it
allows
you
to
get
the
equivalent
single
sign-on
mutual
tls
authentication
across
the
board,
and
then
we
can
take
it
a
step
further,
because
these
are
very
well-defined
standards
and
you
start
looking
at
well.
B
How
do
we
federate
across
like
well,
we
have
two
cas
and
we
can
get
those
cas
to
federate
with
each
other.
At
that
point,
that
gives
us
to
an
area
where,
if,
if,
if
I,
if
my
organization,
if
you
trust
my
organization
to
trust
my
workloads
properly
and
and
I
trust
your
organization
to
attest
your
workloads
properly,
then
we
can
federate
those
top-level
cas
and
that
gets
us
a
global
that
gets
us
a
global,
scalable
environment,
where
we
can
reason
about
the
the
identities
in
a
in
a
secure
way.
I'm.
A
Sure,
most
of
you
will
understand
this
very
well,
but
leaving
kubecon
what
I've
seen
the
majority
of
people
who
understand
the
technology.
Well
is
how
do
they
convince
the
rest
of
the
business,
so
we're
not
going
to
play
slide
that
karaoke
for
this,
but
the
slides
will
be
made
available.
Why?
Why
would
it
matter
to
an
executive?
How
you
do
that
top-down
sale?
A
Why
would
it
matter
to
the
cloud
provider
you
consume
from
and
the
different
services
if
they
put
this
on
their
service
mesh,
they
get
mutual
transport
layer,
security
for
free
and
one
fell
swoop.
Amazon
web
services
app
mesh
implements
aspire
to
accomplish
that,
and
there
are
many
others
that
have
also
followed
suit.
A
We've
included
a
few
more.
Why
would
it
matter
to
the
infosec
team
or
to
security
engineering?
Why
would
it
matter
to
devops
practitioners?
There
are
a
number
of
these
that
we're
going
to
rehash
further
down
while
we're
here
and
given
like
the
objectives
around
regulations,
compliance
that
exists
in
europe.
There
are
couple
compelling
benefits
that
will
appeal
to
you:
the
implementation,
the
reference
implementation
of
the
spiffy
apis,
which
is
aspire,
make
sure
that
ensures
that
identities
are
not
reported
reputable.
A
Reputated
not
reputating.
Thank
you.
So
there's
there's
like
native
encryption.
You
get
all
traffic
in
motion
will
be
encrypted,
which
is
a
problem
at
an
application
layer.
Going
back
to
the
google
story
of
why
google
did
this
when
the
nsa
leaks
happened
and
organization
claimed
that
they
were
able
to
intercept
their
dark
fiber
their
fiber
optics
between
their
data
centers
and
smooth
their
traffic.
Google
executives
issued
a
company-wide
mandate
that
all
traffic
had
to
be
encrypted
at
an
application
layer
because
the
network
was
hostile.
They
couldn't
trust
it.
B
The
lifetime
of
the
certificates
are
kept
very
short,
so
the
the
default
out
of
the
box
is
usually
one
hour,
so
the
keys
get
rotated
every
half
hour
or
so
so
what
this
means
is
you
have
to
constantly
revalidate
the
environment,
and
those
revalidations
could
include
things
like.
Am
I
in
the
correct
geographic
location?
Am
I
do?
A
Just
just
to
add
to
that,
there's
there's
a
lot
of
flexibility
and
customization
for
how
you
design,
trust
boundaries
and
trust
domains
and
having
the
ability
to
have
multiple
routes
of
trust
and
ensuring.
As
we
see
in
the
picture
that
data
in
america
may
travel
to
clusters
and
deployments
in
europe,
but
ensuring
that
data
in
europe
stays
local
stays,
sovereign
stays
non-temperable,
there
are
savings
right.
You
have
witnessed
this
yourself.
B
Yeah
and
so
generally,
when
you
look
at
at
what
executives
look
at
from
a
financial
perspective,
they
there's
usually
two
aspects
you
have
capex
and
optics.
So
usually
what
ends
up
happening?
Is
we
see?
Okay,
there's
an
increase
in
capex,
because
you
have
to
go
off
and
build
the
infrastructure
or
make
that
shift
in
infrastructure,
but
over
time,
as
you
start
to
get
to
a
more
automated
environment,
it
provides
an
opportunity
for
for
opex,
and
part
of
this
is
through
the
enablement
of
automation.
B
So
one
pattern
that
I've
seen
is
when
we
look
at
what
the
current
current
identity
of
most
systems
is:
it's
not
a
cryptographic
identity,
it's
actually
the
ip
address
import
combination.
So
that
means
every
decision
has
to
be
made
upon
what
ipad
or
supports
are
allowed
to
communicate
with
each
other,
and
so
when
it
comes
time
to
make
a
change
like
hey
we're
going
to
sunset
an
application,
you
have
to
look
at
all
of
those
from
max's
control
list.
B
So
so
what
this
allows
us
to
get
to
is
to
to
get
to
a
place
where
we're
able
to
analyze
the
cryptographic
identities
using
things
like
envoy,
oppa,
caverno
and
similar
that
have
integrated
in
spiffy
support,
they're
able
to
make
those
decisions,
and
so,
when
you
make
a
decision
that
hey
this,
this
application
is
being
sunset
and
it's
actually
been
shut
down
or
needs
to
be
mitigated
because
or
needs
to
be
isolated.
Because
of
because
of
a
compromise,
then
that
automation
ends
up
paying
off
through
the
opex
side
of
things.
A
And,
along
with
automation,
the
the
big
problems
of
automation
has
been
developer
productivity
and
efficiencies,
but
going
back
to
learning
curves.
If
you
have
to
be
an
expert
in
the
native
controls
of
google
cloud,
and
then
you
also
need
to
learn
aws,
I
am
it's
really
hard
to
cross
deploy
and
you
need
to
hire
individuals
that
are
certified
in
those
different
areas.
But
if
you're
able
to
reason
holistically
about
a
single
identity,
control
plane
that
abstracts
all
those
underlying
implementation
details,
you
gain
those
efficiencies.
A
We
included
a
chart
here
where
we
see
other
gains,
I'm
not
going
to
cover
them
for
all
all
of
them.
I'm
not
going
to
enumerate
it.
But
if
you
want
to
take
a
picture,
I
see
phones
out.
You
can
also
check
the
slots
lights
online,
also
not
having
if
identity
and
transport
layer,
security
and
cross-cloud
authentication
is
being
provided
by
a
function
of
the
underlying
infrastructure.
A
And
it's
not
something
you
need
to
think
about.
You
don't
need
to
think
about
revoking
and
re
certificate,
revocation
lists
or
you
don't
need
to
think
about.
As
fred
was
alluding
earlier.
How
do
you
go
rotate
force
rotate
because
it's
happening
automatically
and
identities
can
be
aggressively
short-lived
and
you
get
that
by
having
the
underlying
infrastructure
just
the
same
way.
That
kubernetes
does
the
orchestration
for
you
and
you
don't
need
to
think.
A
B
There's
also
a
very
specific
one
of
the
reasons
we've
been
able
to
keep
some
of
the
costs
down
in
this
path
as
well
is
this
is
not
a
new
form
of
let's
go
build
a
new
encryption
scheme.
Let's
go
build
a
new,
a
new
format.
What
it
is
is
it's
leveraging
standard,
so
it's
using
the
x509,
so
the
same
thing
that
you
see
browsers
use
it
integrates
well
with
mutual
tls
and
mutualty,
also
designed
specifically
for
x509
certificates.
B
So
it's
not
like
we're
bringing
in
some
esoteric
set
of
protocols
and
say
use
this
thing
and
replacement
of
things
like
tls
and
said
we're
saying,
go
use
mutual
tls
go
go
use
the
standards.
What
is
what
spiffy
is
providing?
You
is
two
primary
things.
The
first
one
is
a
very
well
defined
document
so
that
you
can
reason
about
other
identities.
That
may
not
be
part
of
your
immediate
infrastructure.
B
The
second
thing
it's
providing
is
a
set
of
apis
that
define
how
to
automate
the
rotation
of
those
certificates
and
how
to
how
to
automate
the
delivery
of
of
that
information.
So,
by
focusing
primarily
on
those
two
things
and
saying
we're
going
to
focus
in
on
maintaining
standards,
it
provides,
it
provides
a
it
ends
up
allowing
you
to
to
use
your
your
current
existing
mutual
tls
implementations.
A
A
There
are
more
savings
again
this.
This
came
out
from
organizations
that
have
done
this
at
extremely
large
scale,
globally,
deciding
to
contribute
it
to
the
rest
of
the
world
and
they
spent
years.
They
spent
a
lot
of
engineering
resources
to
build
this,
to
put
the
different,
integrations
and
plug-ins,
but
it's
readily
available
for
you
to
consume
so
you're
saving
on
that
development
time
and
the
cost
of
going
on
on
that
journey
on
that
path.
On
on
your
own
there's,
all
this
concerns
of
like
you'd,
have
to
think
about.
A
A
B
Yeah
one
of
the
one
of
the
main
things
that's
come
recently
was
this
the
at
least
in
the
reference
implementation.
Spire
was
the
ability
to
support
cloud-based
kms
systems,
and
so
part
of
the
reason
you
would
want
to
bring
in
the
kms
is
that
if
the
application
is
or
infrastructure
is
compromised,
the
kms
allows
you
to
shut
off
access
to
the
signing
keys
and
allows
you
to
control
and
log
when
those
keys
are
are
issued
out.
A
Yeah
absolutely
so
last
last
set
of
outcomes
before
we
start
moving
into
a
scenarios.
It's
like
sure
this
is
awesome.
How
do
I
explain
this
to
my
security
team?
Why
would
they
care
a
big
mandate?
Organizations
are
moving
towards
is
implementing
a
zero
trust
architecture,
but
there's
no
path
to
zero
trust.
Unless,
when
you're
breaking
ground
for
the
construction,
you
you
do
a
strong
foundation
of
identity.
This
has
to
be
a
steel
thread
to
support
granular
identifiable,
know
who
the
subjects
are
in
your
distributed
system.
A
You
cannot
do
zero
trust
if
you
have
a
black
box
so
once
you
know
the
subjects
the
objects
that
they
access,
what
are
the
different
relationships?
What
are
the
communication
pathways?
You
can
make
zero
trust
policy
assertions
if
they
are
a
very
defense
driven
security
team.
You
can
converse
with
them
about
the
owasp
top
10.,
the
top
10
most
prevalent,
cyber
security
attacks
for
web
applications.
A
A
The
first
thing
that
it's
going
to
ask
the
aspire
agent,
which
implements
the
spiffy
workload
api
is,
who
am
I
and
the
agent
will
initiate
a
set
of
parallel
introspections?
It's
going
to
ask
the
linux
kernel
for
its
metadata,
what
sgid,
what
pit
etc?
It's
going
to
come
back
to
cubelet
and
say:
hey
cubelet,
who
scheduled
this?
Was
it?
Was
it
the
controller?
In
fact,
what
metadata
do
you
have?
What
namespace?
A
What
service
account
token?
If
it's
running
and
let's
pick
amazon
web
services,
it's
going
to
interrogate
the
aws
instance
metadata
api
and
say
hey
what
availability
zone
is
the
underlying
machine
in
what
security
group
and
if
everything
matches
the
way,
it's
intended
to
look
the
way
you've
defined
it
up
front,
registering
workloads
every
time,
regardless
the
environment.
A
A
It's
the
api
documents
of
how
do
these
apis
conform
by
a
compliant
spiffy
implementation.
Spire
is
actually
running
this
in
software.
There's
a
few
spy
components.
There's
a
server
there's,
there's
an
agent
there's,
exposing
the
workload
api.
There's
a
federation
api
to
talk
about,
to
talk
across
multiple
deployments
to
talk
to
cloud
providers
and
you
see
a
little
like
half
half
life
cycle
of
what
that
looks
from
spec.
But
this
is
also
what
aspire
implements.
A
B
So
one
thing
to
be
aware
of
is
that
spiffy
and
spire
themselves
are
they're,
not
a
service
mesh,
so
all
it
does.
Is
it
provides
authentication
of
workloads
and
provides
a
path
to
to
maintain
that
and
and
to
into
validate
and
and
make
and
learn
something
about?
What
that
workload
is
so
a
large
part
of,
what's
of
what's
necessary,
to
make
it
useful
is
that
you
have
to
have
integration
with
other
with
other
components,
and
so
we
so
that
it
integrates
with
things
like
envoy,
where
envoy
is
able
to
consume
that
spiffy
identity.
B
It's
able
to
make
use
of
it
able
to
validate
their
mutual
tls.
The
remote
system
that
it's
connecting
to
there's
there's
integration
with
with
istio,
where
istio
was
using
spiffy
identities
in
order
to
to
determine
what
the
workloads
are.
There's
recent
work
that
was
done
as
well,
that
should
be
in
the
latest
seo
version
that
also
allows
it
to
connect
into
the
re
to
the
spire
server
that
we
described
before,
which
helps
get
us
to
the
point.
B
Where
we're
as
mentioning
that
that
identity
is
the
the
kubernetes
cluster
itself,
is
an
identity
provider
or
the
application
on
top
of
this
identity
provider
helps
us
move
away
from
that.
So
we
get
to
that
place
where
we
can
have
an
external
identifiable,
defendable
identity
provider,
and
we
then
are
able
to
hook
in
clusters
into
those
into
those
environments,
so
they're.
So
the
so.
The
key
here
is
that
is.
A
And
this
is
not
exclusive
for
production
systems
at
runtime.
There's
active
work
for
applying
the
virtues
of
spiffy
inspire
to
the
supply
chain,
ranging
from
protecting
your
signing
and
verification,
tooling,
protecting
and
total
machinery.
If
you've
seen
project
six
store
and
cosign,
they
implement
spf
identity
documents.
A
There
are
several
areas:
a
great
person
to
talk
to
marina
moore
in
the
back
maintainer
of
entoto,
recently
published
the
secure
supply
chain
reference
architecture
and
it
it's
predicated
on
strong
cryptographic,
identity
to
ensure
the
integrity
from
commit
from
source
all
the
way
to
build
and
shipping
an
artifact
and
going
back
to
the
attestation
being
able
to
determine.
Has
this
binary
been
signed?
Does
it
have
a
binary
signature
that
I
expect
to
see
or
not?
B
A
really
good
example
of
that
as
well
is
that
when
you
look
at
spiffy,
spiffy
is
designed
specifically
for
that
ephemeral
identity.
Are
you
a
member
of
my
system
right
now,
or
are
you
a
member
of
a
system
that
I
trust
right
now,
so
it
is
not
designed
for
let's
go
validate
the
certificate
a
year
from
now,
because
those
certificates
will
get
rotated
over
time,
and
so
so
part
of
it
is
like
when
you
start
looking
at
supply
chain
providence,
it's
like
well.
B
How
do
we
take
something
that
is
now
use
that
to
bootstrap
the
signing
process
so
that
something
can
then
sign
it
at
that
particular
time
for
for
the
long
term
and
still
have
enough
information
there
that
you're
able
to
still
reason
a
reason
about
it?
So
there's
a
there's
a
really
nice
collaboration
between
these
short-term
spiffy
identities
and
hitting
the
long
term
needs
of
like
I
signed
something.
I
need
to
be
to
be
able
to
validate
a
year
two
years
down
the
line
that
this
thing
was
signed
by
by
that
entity.
A
E
Matt
hello,
so
let's
say
I'm
running
kubernetes
and
seo
you
mentioned
before
that,
like
seo,
uses
like
spiffy
and
stuff
and
around
like
kubernetes
is
essentially
like
workload
provider.
Am
I
essentially
using
a
spiffy
and
like
workload,
identity,
I'm
if
I
am
using
istio
or
I
guess,
linkard
assuming
linked
use,
is
the
same
yeah.
I
know.
B
At
it
yeah
because
it
the
the
thing
with
it,
is
that
when,
when
istio
first
made
use
of
of
spiffy,
so
they
they
used
it
to
to
produce
the
workload
identity.
So
you
are
using
spiffy
when
you're
using
istio
one
of
the
challenges
we've
we've
had,
that
we've
been
working
towards
is
well.
How
do
we
handle
the
federation
story
because
the
from
the
federation
aspect
of
it
that,
if,
if
you
don't
have
that
ability
to
federate
across
environments
and
then
you're
you're
limiting
your
identity
to
that
specific
cluster?
B
There
are
a
couple
things
you
can
do,
so
you
could
say
well
we're
going
to
put
a
ca
at
the
top.
That
will
then
sign
an
intermediate
and
then
istio
will
then
issue
it
out.
So
that
can
help
with
federation.
Okay,
but
part
of
part
of
something
that
that
we've
had
discussions
on
is
like.
How
do
we
get
the
federation
apis
themselves
to
become
part
of
the
standard?
Which
means
that
when
you
want
to
communicate
across
boundaries,
then
the
the
first
thing
you're
doing
is
you're.
B
Turning
towards
a
standardized
way
to
to
approach
that,
and
then
it
means
that
you're
not
relying
purely
on
something-
that's
spiffy,
spec
or
sorry
spiffy,
like
istio
specific
to
to
establish
like
through
transit
gateways
or
similar,
and
transferring
all
that
information
to
and
from
the
systems.
But
that
would
help
provide
a
way
that
you
could
reason
even
across
boundaries,
where
the
thing
that
you're
communicating
with
might
not
even
be
in
the
same
company
as
you.
So
there's
there's
some
work.
That
needs
to
be
done
towards
towards.
A
There
is
recent
upstream
work
led
by
max
lamrick
from
hpe,
where
he
implemented
the
interfaces
to
very
elegantly
swap
citadel,
which
is
istio's
native
identity
system
for
spire.
In
the
past
it
was
quite
cumbersome
and
across
releases
it
would
break,
but
we
we've
gotten
that
I
had
also
opened
an
issue
that
the
team
over
by
tetrad
they
have
a
booth
in
the
expo
floor,
implemented
federation
in
both
envoy
and
istio
to
achieve
cross-cluster,
mtls
and
authenticate
on-mesh
to
off-mesh.
A
So
if
you
do
just
the
spiffy
within
istio,
the
legacy
implementation,
all
you
can
do
is
within
cluster
with
a
lot
of
heavy
lifting
cross
seo
cluster.
But
if
you
do
spire,
you
can
have
side
card
non-service,
mesh,
traditional
workloads,
running
on
bare
metal
that
are
spiffy
identified,
cross
authenticate
and
really
blurs
that
service
mesh
does.
E
B
C
D
F
A
Great
question
so
attestation
occurs
at
two
levels:
we
didn't
cover
node
attestation,
but
it
is
the
process
of
verifying
the
authenticity
and
integrity
of
the
underlying
machine,
whether
that
is
spare
metal
using
an
x509
pop
from
your
root
of
trust
or
that's
a
cloud
virtual
machine.
There
are
a
number
I
will
happily
share
with
you.
The
threat
model
we've
done
both
the
q53
security
audit,
where
they
scrutinized
the
project.
Also,
the
team
over
and
nyu
tandon
labs
had
insert
the
security
boundaries
of
well.
A
D
F
F
A
You
brandon
that's
that's
spot
on
there's
efforts
that
are
far
along
there's
an
existing
tpm
attestation
that
was
contributed
upstream
by
bloomberg.
Financial
there's,
also
a
team
of
researchers
in
a
university
in
brazil
that
are
doing
work
around
sgx
and
secure
enclaves,
and
it's
pretty
far
along
and
they've
just
galvanized
the
community.
G
A
G
A
Sure
so
you
you
define
a
spiffy
id
that
may
be
a
spiffy
colon,
slash,
slash,
kubecon,
mall
level,
slash
spiffy
session.
This
is
something
that
has
yet
to
be
born
or
increment,
but
we
are
gonna
deploy
it
at
one
point.
We
may
have
multiple
instances
if
we
scale
up
a
kubernetes
service
and
there's
a
hundred
pots
for
this,
so
you're
defining
conceptually
the
kid
that's
about
to
be
born.
This
is
the
name
that
we're
gonna
give
it.
A
If
the
dna
test
checks
out
the
paternity
test,
checks
out
and
it's
the
mom
and
the
dad
and
it
has
the
height
the
weight
all
these
aspects,
then
you
issue
the
birth
certificate.
If
you
may
and
then
ensure
that
that
is
protected
and
that
kid,
in
order
to
go
to
throughout
life,
that
a
birth
certificate
converts
into
a
passport
or
a
driver's
license,
and
that
needs
to
federate
and
go
through
like
checks
of
different
countries,
I'm
going
a
little
bit
far
off
with
the
analogy,
but
hopefully
that
that
illustrates
it.
A
C
A
B
A
B
A
Com
participate,
we
we
are
a
growing
community
contributing
it
starts
simply
as
showing
up
my
own
personal
journey
and
an
open
source.
I
had
a
lot
of
imposter
syndrome.
I
didn't
feel
I
was
like
at
the
level
of
the
experts
or
the
idea
that
I
had.
If
I
thought
of
it,
someone
must
have
already
thought
of
it.
They're
working
on
it
please
come
hang
out,
be
vocal.
Tell
us!
What's,
on
your
mind,
tell
us
what
are
the
problems
that
matter
to
you.
We
can
really
build
this
together.
A
B
There's
there's
also
a
ecosystem,
that's
trying
to
develop
around
some
of
this
as
well,
so
it's
not
just
about
like
spiffy
and
spire,
but
also
the
tooling
that
that's
developing
around
it
there's
a
number
of
opportunities
that
for
collaboration.
So
one
example
is
that
we
we
very
specifically
do
not
put
claims
inside
of
the
the
spiffy
document,
others
than
some
very
basic
predefined
claims.
So
there
were
some.
B
There
were
some
very
good
reasons
around
like
trying
to
avoid
pre-authentication
pre-authorization
being
stuck
inside
of
the
claims
that
we
didn't
want,
or
the
x509
itself
is
also
very
rigid.
It's
like
all
or
nothing
if
you
put
the
claims
and
you
can't
like
select
certain
claims
and
put
them
out,
but
there's
there's
opportunities
around
okay.
Well,
how
do
we
deal
with
claims?
How
do
we
deal
with
with
the
federation
or
transitive
identity?
So
these
are
really.
A
Super
interesting
unresolved
problems
at
an
industry
industry
level.
We
also
need
help
with
our
documentation.
We
also
need
help
with
tutorials.
We
also
need
help
with
like
novel
ways
to
tell
compelling
narrative
so
yeah
any
and
all
contributions.
Thank
you
for
your
time
and
letting
us
hold
the
space.
F
D
G
C
Can
find
these
two
lads
downstairs?
Hopefully
I
mean
don't
just
pin
them
to
this
room
and
not
let
them
get
down
there,
because
I
know
there's
more
questions
that
haven't
been
answered
yet,
but
I
really
want
to
thank
them.
These
are
two
of
my
favorite
members
of
the
community,
frederick,
and
I
go
so
far
back.
I
chose
this
talk
because
it's
an
interesting
top.
I
love
that
book.
The
bottom
turtle
I
stalked
him
at
coupon
la
until
he
signed
a
copy
for
me
really
good
stuff.