►
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
SPIRE: Intro & Deep Dive Into Windows Support - Agustín Martínez Fayó & Marcos Yacob, Hewlett Packard Enterprise
Join this session for an introduction of the SPIRE project and deep dive into the new Windows support. SPIRE (the SPIFFE Runtime Environment) implements the SPIFFE standards to securely identify software systems in dynamic and heterogeneous environments. This session provides a high level overview of the basic concepts behind SPIRE and why you should consider it if you find issuing workload identities at scale challenging for you. This talk will also give a deep dive into the Windows support that is being introduced in SPIRE, offering detailed information about the implementation details, what is the difference between running SPIRE on Windows and Linux platforms, and how will be the experience from both a user and developer perspective.
A
B
A
A
A
A
A
A
A
A
A
A
A
We
can
see
here,
despite
the
spiro
agent,
that
has
plugins
both
the
agent
and
the
server
are
made
of
plugins
and
that
provides
spire,
an
architecture
that
is
pretty
flexible.
That
allows
you
to
grow
depending
on
the
needs
like,
for
example,
if
there
is
a
new
platform
or
vendor
that
you
want
support.
A
Okay,
so
at
this
point
you
may
wonder
if
adopting
inspire
is
a
good
idea
for
you
or
for
your
organization
or
company.
Let's
try
to
see
what
are
the
problems
that
spire
solves
and
try
to
figure
that
out,
so,
if
you're,
maybe
struggling
with
issuing
workload
identities
to
workloads,
because
maybe
because
they
are
running
in
different
platforms
or
you
have
workflows
running
on
prem
and
in
the
cloud
looks
like
this
part
is
a
very
good
fit
for
that,
because
it
can
issue
platform,
agnostic
identities
in
an
automated
way.
A
Inspire
may
expire
in
one
hour
and
inspire
can
can
handle
that
and
if
you
maybe
want
to
compare
or
want
to
see
what
other
organizations
have
been
doing
with
this
with
aspire,
how
they
have
been
adopting
spire.
You
can
look
at
the
adopters
md
document
that
we
have
inspire
repo.
You
will
see
there
are
many
different
examples
of
the
adoption
of
spire
with
different
use
cases
and
how
spire
is
being
used
right.
So,
let's
get
into
the
new
windows
support
the
window.
Support
is
being
introduced
as
an
experimental
feature.
A
A
We
did
work
to
adapt
existing
plugins
and
also
created
a
new
plugin,
that
is
the
windows
workload,
a
tester
that
is
able
to
test
windows,
workload
based
on
windows,
specific
attributes
or
selectors,
and
the
the
plugin
that
we
have
updated
is
the
docker
workload
tester.
We
will
see
how
that
works
in
the
demo.
A
A
B
B
This
product
api
will
have
an
entry
that
is
configured
to
work
with
the
windows
attacher
in
another
site.
We
will
have
two
services
running
in
different
containers:
the
web
app
and
the
customer
api
hsm
will
communicate
with
this
expiration
through
the
world
api
and
fetches
bits
using
entries
that
have
dockers
at
store.
Selectors.
B
B
C
B
B
B
That
is
enough
about
configuration.
Sorry,
I
will
start
our
agent
on
our
server
for
this
demo.
I
created
some
scripts
that
will
that
will
be
useful
for
everything
to
create
entries
to
start
server.
All
these
scripts
are
online
in
my
repo.
They
will
be
displayed
after
finished,
but
you
can
take
it,
take
it
and
verify
so.
I
will
start
server
and
our
agent
here
we
see
that
the
server
is
started
successfully.
B
So
I
will
create
them
for
this
demo.
In
total,
we
have
three
entries.
One
is
for
our
web
app
that
has
aspirin
id
the
spf
id
of
the
agent
which
has
started
it
has
a
ttl
of
60
seconds.
It
is
unreal,
it's
not
useful
to
have
speed
with
this
amount
of
time,
but
it's
just
for
the
demo
to
make
things
rotate
faster.
B
The
selectors
are
both
of
for
docker
a
tester.
In
this
case,
it
is
expecting
that
the
process
that
is
calling
the
world
api
have
the
image
id
web
app.
That
is
our
first
case
and
the
label
docker
compose
service
web
app
in
case
of
our
customer
api
is
almost
the
same.
The
same
pattern
same
gtl,
but
the
difference
here
is
that
it
is
expecting
for
customer
api
for
docker
compose
service
customer
api.
B
B
In
this
case,
the
processor
are
running
for
the
user
name
administrator.
Will
get
this
speed
for
this
demo?
I
choose
a
simple
selectors,
but
if
you
move
to
the
documentation
on
inspire,
you
can
see
the
complete
list
of
selectors.
We
are
able
to
use
in
case
of
docker,
we
have
the
label
and
we
are
using
environment
variables
and
image
id
in
case
of
windows.
We
are
supporting
user
security,
id
username
and
different
selectors
related
with
groups.
B
B
B
B
B
B
B
So,
as
soon
as
it
is
updated
and
I
move
to
logs,
I
will
start
seeing
that
the
communication
between
non-communication
the
agent
is
no
longer
able
to
provide
speech
to
the
web
app
and
the
error
is
permission
denied
no
identity
issued.
You
will
ask
me:
why
is
happening
in
the
process
of
attestation
when
a
process
is
calling
our
agent,
we
calculate
using
different
queries
to
kernel
apis,
we
calculate
info.
B
We
get
information
about
that
process,
for
example,
who
is
running
it
in
case
of
the
username
in
case
of
docker,
the
image
id
the
different
information
we
want,
and
with
that
all
that
information
we
compare
it
a
illustration
process
with
the
all
the
entries
and
that
that
entry
have
all
the
selectors
we
want
in
the
case,
because
I
updated
the
level
to
another
one
that
is
not
long.
It
is
not
longer
possible
and
it
starts
failing.
B
If
I
move
to
the
server
sorry
to
the
web
app
and
if
it
pass
time
remember
it,
I
put
a
special
time
of
60
seconds.
So
in
the
time
it
was
a
talking,
the
sphere
is
expired
and
we
start
getting
the
error.
In
the
connection,
if
we
go
to
there,
we
will
see
that
it's
because
it
is
not
possible
to
use
and
immediately
start.
A
A
C
A
D
A
B
Yes,
basically,
if
you
take
a
look
to
how
the
tester
works
on
linux,
we
depends
of
the
c
groups
in
case
of
we
know
that
it
does
not
exist.
What
exists
a
replacement,
that
is
the
object
shops
that
option
shops
has
a
name
this
container
id.
So
what
basically
we're
doing
now
is
verifying
between
the
resource
jobs.
If
the
process
we
are
getting,
the
call
is
running
with
that
job.
It's
actually
successful
and
we
are
able
to
with
that
id.
B
B
D
B
A
B
B
C
B
A
B
Windows
on
windows,
11
and
word
two
okay,
but
in
my
in
this
demo,
was
used
in
windows,
servers
2022.
I
think
that
is
the
last
one,
because
the
image
I
built
was
there.
You
can
take
a
look
to
the
image
and
you
can
change
the
image
because
they
call
the
code
to
create
image
is
in
the
demo,
so
you
can
change
the
version.
If
you
want
any.