►
Description
Community Integrations and other Works in Progress - Umair Khan
This session would cover new community integrations and initiatives being worked on by community members. Guest speakers, along with their topics, include:
Extending Authentication for Istio with SPIRE – Doron Chen, IBM
Securing user privacy with transitive identity – Andrew Jessup, HPE
Leveraging certificate transparency to strengthen audibility in SPIRE - Ruide Zhang, ByteDance
Parsec and SPIFFE – Paul Howard, Arm
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2021 Virtual from May 4–7, 2021. Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
A
So
what
we
wanted
to
spend
like
andrea's,
mentioned
a
bit
as
well.
There
are
a
lot
of
work
being
done
by
the
community
by
the
maintainers
to
integrate
spiffy
inspire
between
the
broader
ecosystem,
so
I'll
provide
a
quick
recap
on
that.
In
addition,
we
have
some
interesting
work
being
done
by
a
few
community
members
that
they'll
be
sharing
and
giving
an
update
around
that
as
well.
So
so,
first
of
all,
especially
inspire,
I
think
the
team
has
been
really
busy
since
the
last
kubecon
we
had
added
various
integrations.
A
We
already
are
integrated
with
popular
cloud
platforms,
bare
metal,
different
service,
mesh
and
other
open
source
software,
so
do
check
you
can
check
these
integrations
out
on
the
github
url
mentioned
there.
But
again,
this
is
the
integration
that
we
know
of
right.
We
have
a
growing
community
of
contributors
who
are
doing
integrations
doing
contributions
all
the
time.
We
don't
really
know
about
them
until
you
know
they
get.
You
know
included
in
the
upstream
as
well.
A
So
if
you
have
any
other
integrations
mind
if
you
want
to
contribute
to
any
integrations,
if
you're
looking
to
integrate
specific
inspire
with
anything
else,
you
know
do
reach
out
to
us.
So
some
of
this
new
stuff
that
has
been
recent
a
lot.
We
have
seen
a
lot
of
service
mesh,
have
started
to
use
a
specie-inspired
network
service
mesh,
which
is
a
cncr
project
focused
on
delivering
hybrid
multi-cloud.
Ip
service
mesh,
I
think,
are
tightly
integrated
with
specific
inspire
frederick
is
also
who's.
A
One
of
the
maintainers
of
the
project,
we'll
also
be
doing
a
session
later
on
on
on
his
integration
story
within
his
organization
as
well.
We
also
have
nginx
recently
introduced
a
service
mesh,
and
the
solution
is
integrated
with
fifi,
especially
inspired,
as
is
a
core
identity
control.
Plane.
Fessel
will
be
mentioning
that
a
bit
in
his
crd
session
later
on
as
well
open
service
mesh
is
another
upcoming
open
source
project.
It's
a
lightweight
extensible
cloud
native
service
mesh.
A
There
are
definitely
plans
there
to
integrate
with
spiffy
and
spire
as
well
dapper
a
new,
a
relatively
new
event-driven
programming
model
driven
by
the
microsoft
team.
I
believe
they
recently
had
a
new
release
and
the
dapper
workload
certificates
are
now
specific
compliant
and
carry
a
strong,
specific
identity
for
each
workload.
A
In
addition,
we
have
emissary
from
github
is,
which
is
a
bridge
between
service
proxy
spiffy
is
applied
there
to
apply.
You
know
authentic
policies
within
that
tool
as
well.
We
also
have
an
integration
pretty
much
done
between
another
open
source
project
parsec.
I
won't
talk
too
much
on
that,
because
paul
from
that
project
will
be
talking
in
a
bit.
So,
as
I
said
mentioned
before,
the
next
upcoming
talks
are
by
community
members
who
have
done
some
interesting
work
with
specific
inspire.
B
B
B
B
D
B
B
But
if
you
use
spy
on
the
other
hand,
you
can
base
identities
on
a
wide
range
of
conditions
and
not
just
the
name
spaces
and
sense
accounts.
So
we
we
were
particularly
interested
in
determining
the
identity
of
a
workload
based
on
the
container
images
of
all
containers
running
within
a
pot
in
our
proof-of-concept
experiment.
B
We
use
spire
to
issue
the
same
spf
identities
that
would
have
been
issued
by
the
istio
identity
mechanism.
So
a
few
words
about
our
motivation
using
spire
allows
us
to
only
issue
identities.
After
an
attestation
process
has
taken
place,
ensuring
that
all
required
required
conditions
are
met.
Implicitly.
This
also
means
that
if
the
conditions
are
not
met,
then
the
workload
will
not
get
any
identity
and
would
not
be
able
to
to
communicate
with
any
other
services.
B
The
main
use
case
for
using
spy
identities
is
federation
federation
would
allow
workloads
running
within
istio
to
communicate,
to
communicate
with
workloads
in
other
easter
clusters.
It
would
also
allow
workloads
in
istio
to
com
to
communicate
with
workloads
running
outside
of
istio
in
just
about
any
environment.
B
B
B
Thanks,
okay,
so,
finally,
if
you
are
interested
in
this
work,
you
have
here
the
a
link
to
our
repository.
It
explains
how
to
recreate
our
experiment
step
by
step.
We
welcome
contributions
below
it.
You
can
find
a
link
to
a
blog
that
we
wrote
explaining
in
greater
detail
our
motivation
for
this
work.
A
A
Great
great,
thank
you
so
much
doran,
if
you,
if
you
can
hang
around
for
a
few
more
minutes,
if
you
have
any
questions
for
doran,
please
you
can
put
them
in
the
chat
window.
There's
the
option
of
you
know
interacting
with
doran
on
the
kiko
chat
feature
as
well,
which
was
the
browser
that
you
use
to
get
into
the
zoom
chat
up
next.
C
C
C
Any
any
particular
you
want
to
redirect
your
attention
about
like
what
are
the
the
sharp
edges
or
trade-offs
here,
perhaps
like
you
need
to
have
parsing,
and
everything
else
expect
that
if
you're
the
time
you're
doing
federation,
things
would
need
to
look
pretty
much.
The
same
in
other
service
meshes
correct.
B
Right
so,
in
order
not
to
to
break
things,
we
we
use
the
same
schema
as
as
istio,
so
that
did
not
change,
but
the
mechanism
of
give
of
giving
the
the
identities
is
now
totally
different.
So
we
can
use
all
the
all
spire
selectors
in
order
to
to
determine
what
conditions
need
to
to
occur
in
order
for
for
an
identity
to
be
given.
B
B
C
E
Beautiful,
hopefully
my
internet
holds
out
apologies
if
it
doesn't
so
I
I
know
we've
only
got
a
couple
of
minutes
together
good
morning
good
afternoon
good
evening,
wherever
you
are
thanks
for
joining
we're.
Gonna
spend
a
couple
of
minutes
on
on
this
topic
of
transitive
identity.
Firstly,
wanted
to
recap
what
transitive
identity
is
and
I've.
I
tried
last
night
at
about
midnight
to
come
up
with
a
sort
of
a
concrete,
pithy
definition.
E
I'm
not
sure
I
succeeded,
but
let's
try
anyway,
what
transitive
identity
is
is
about
adding
additional
authentication
context
to
a
receiving
workload
so
that,
in
addition
to
being
able
to
verify
the
identity
of
my
proximal
immediate
caller,
I
can
also
bring
into
my
authentication
and
authorization
decision
additional
authentication
context
about
upstream
parties
that
might
have
been
involved
in
in
an
interaction,
perhaps
an
easier
way
of
explaining.
This
might
be
to
look
at
some
actual
use
cases.
So
a
common
one
here
is
is
delegated
authentication.
E
So
as
an
example
on
the
left-hand
side,
here
we've
got
a
user
michelle
she
logs
into
a
web
application.
Let's
say
that
web
application
is
maybe
like
a
mail
client
and
the
the
web
application
then,
which
is
authenticated.
Michelle
is
now
going
to
talk
over
a
private
api
to
a
back-end
system
in
order
to
retrieve
retrieve
michelle's
mail.
E
It
would
be
nice
if
the
back
end
the
team
running
the
back
end
infrastructure
was
able
to
verify
not
only
that
the
web
app
was
the
party
calling
them,
but
also
that
michelle
had
authorized
the
retreat.
It
was
that
the
web
map
had
a
valid
authentication
context
from
michelle
and
maybe
even
a
valid
authorization
context
as
well
to
retrieve
email.
E
Another
use
case
that's
similar,
but
is
quite
an
interesting
one,
is
when
you
have
a
long-running
task
that
a
user
has
initiated
so
by
a
long-running
task.
That
might
be
say
a
render
job.
It
might
be
a
ci
cd
job,
but
any
case
really
where
you
know
as
a
user
again,
I've
gone
and
interacted
with
some
system
and
that
system
is
spinning
off
a
job.
On
my
behalf,
again,
let's
say
it's
a
ci
cd
job.
E
E
So
this
is
another
case
where
some
idea
of
transit
of
identity
would
be
useful
here,
it'd
be
fantastic
if
the
task
was
able
to
present
not
only
its
own
identity
as
a
workload,
but
also
michelle's
identity
or
a
proxy
for
michelle's
identity,
or
for
that
matter,
the
scheduler's
identity
as
well
to
a
resource
in
order
to
be
able
for
the
resource
to
be
able
to
make
that
kind
of
authorization
decision
and
there's
a
few
variations
of
these
kinds
of
use
cases
as
well.
It's
a
it's
a
complex
and
fairly
challenging
problem.
E
E
I
forgot
to
put
the
link
on
there,
but
if
you,
if
you
browse
around
us
slack
channels,
we'd
be
happy
to
point
you
in
the
right
direction,
if
you're
interested
in
joining
this
working
group
and
participating
in
this
process,
but
we
set
up
a
working
group
to
explore
this
problem
and
we
started
that
working
group
by
soliciting
some
real
world
case
studies.
So
we
had
some
colleagues
from
folks
like
bloomberg
and
adaptance
and
netflix.
E
You
know
all
took
their
time
out
to
walk
through
how
they
were
would
like
to
or
either
were
employing
transitive
identity
in
the
real
world
and
those
grounded
real
world
use.
Cases
turned
out
to
be
really
important
because
when
it
comes
to
a
topic
like
transitive
identity,
there's
a
lot
of
trade-off
decisions,
you
can
make
between
complexity
and
ease
of
implementation
and
robustness
and
security,
and
and
seeing
how
people
had
solved
for
those
problems
in
a
in
a
grounded.
Real-World
setting
helps
us
make
some
of
those
design
decisions.
E
For
two
reasons:
one
is
we
don't
want
to
reinvent
the
wheel
if
there
are
already
great
standards
to
solve
for
this?
Let's
let
that
community
or
let's
figure
out
how
to
integrate
with
and
support
those
standards,
rather
than
reinvent
the
wheel
and
secondly
as
well
to
make
sure
that,
to
the
extent
that
they've
been
standards
that
have
proposed
that
hadn't
really
seen
adoption
in
market.
What
can
we
learn
from
that?
E
What
can
we
do
to
make
sure
that
we're
not
repeating
those
same
mistakes,
so
we
so
so
we
we
went
through
and
reviewed
that,
and
we
came
up
with
you
know.
First
of
all,
a
set
of
design
principles
that
we
wanted
to
assert.
You
know
a
set
of
kind
of
grounded
principles
for
what
you
know.
Spiffy's
implementation,
or
at
least
initial
implementation
of
of
transit
identity
should
be.
We
actually
carved
out
a
subset
of
that
problem.
E
We
call
delegated
authentication
and
we
we
put
our
heads
together
and
put
up
with
a
put
together
a
proposal.
This
proposal
is
still
very
much
a
work
in
progress.
It's
you
know
it's
had
some.
You
know
real
world
grant.
You
know
it's
had
some.
It's
had
some
initial
review
from
the
working
group
team.
What
we're
now
doing
is
is
bringing
this
to
spiffy
itself
and
seeing
because
it
the
the
proposal
as
it
stands
implies
some
extensions
to
the
spiffy
spec.
E
In
particular.
A
new
token
format
called
the
da
svet
for
providing
delegated
asserted
claims,
we're
now
putting
that
in
front
of
six
spec
and
we're
starting
that
discussion.
It's
been
a
really
reverse,
really
useful
and
robust
discussion.
So
far,
it
turns
out
the
problems
that
we're
trying
to
solve
to
solve.
E
E
Sure
great
question
so
delegated
or
so
yeah
we've
tried,
with
spiffy
in
general
to
to
disaggregate
authentication
and
authorization
as
much
as
possible
and
and
the
reason
for
that
is,
it's
generally
easier
to
provide
to
build
a
a
general
purpose.
Authentication
framework
that
supports
a
whole
set
of
different
use
cases
than
it
is
to
provide
authentication
and
authorization
in
the
same
form
in
the
way
that
say,
oauth2
does,
to
the
greatest
extent
possible.
We've
tried
to
do
that
with
with
delegated
authentication
as
well.
E
A
Great,
thank
you
so
much
aj.
I
know
we
are
pressed
for
time.
I
apologize,
I'm
gonna
run
into
the
break
a
bit,
but
I
do
have
a
couple
more
speakers
up
next,
as
augustine
mentioned
about
certificate
transparency,
the
big
big
topic
within
the
spire
community
and
we
have
reed
zhang
from
bite,
dance
he's
gonna,
take
walk
us
through
his
proposal.
D
Great
and
thank
you
for
introduction
and
thank
you
for
inviting
me
and
I'm
ray
de
jang,
and
you
can
also
call
me
reed,
so
I
currently
work
at
finance
and
we
are
known
for
the
creator
of
tick
tock.
So
here
I
bet
by
dance.
We
heavily
integrate
with
the
fire
to
implement
our
like
identity
management
system
for
our
production
network,
and
during
that
we
notice
that
in
the
current
spire
there
is
actually
no
very
good
way
to
perform
auditing
on
the
issued.
D
Svs
like
for
those
who
are
new
to
spire
sv
is
basically
the
id
card
for
an
entity
in
the
network.
So
in
this
work
we
try
to
provide
audibility
to
aspire.
We
leverage
a
well-known
technology
called
certificate,
transparency
or
ct,
and
cd
was
first
proposed
to
enforce
public
auditing
on
certificate
authorities
for
web
pki,
and
in
our
case
we
applied
the
essential
ideas
of
cte
to
spire,
so
that
we
could
enforce
auditing
on
all
of
the
svs
issued
by
the
spy
server.
And
this
way
it
can
significantly
significantly
mitigate
the
risk
of
fire
server.
D
D
D
And
in
this
slide
we
show
an
example
of
issued
x,
509
xp,
with
sct
embedded,
the
yellow
highlighted
parts
are
the
sct
field
and
all
newer
version
of
open
ssl
should
be
able
to
parse
sct
field
in
the
x
509
certificate.
This
certificate
is
generally
generated
by
our
experimental
fork
of
fire
server
and
our
current
fork.
All
svs
would
have
sct
embedded
and
these
sdts
are
actually
fetched
from
our
own
internal
city
service.
D
D
Yeah
sure
and
yeah-
and
I
think
we
started
the
the
working
group
three
months
ago
and
there
have
been
some
like
back
and
forth
discussing
and
we
are
also
discussing
on
the
on
the
github
rfc
issue.
So
you
are
most
welcome
to
check
that
out
and
yeah
and
shout
out
to
the
great
of
great
work.
The
speedy
community
has
been
working
on
and
thank
you
for
inviting
me
and
that's
it
for
me.
D
A
F
F
So
thanks
amer
and
thanks
for
the
opportunity
to
to
join
this
session
and
quickly
talk
about
the
work
we're
doing
with
with
spiffy
and
spire
and
parsec,
so
just
to
quickly
introduce
myself,
I'm
paul
howard
solutions,
architect
with
arm-
and
I
lead
an
engineering
team
here
at
arm
that
is
contributing
into
parsec.
Parsec
became
a
cncf
sandbox
project
just
earlier
this
year,
and
so
what's
parsec
well
past
the
platform
abstraction
for
security,
it's
providing
ways
for
cloud
native
applications
to
access
the
security
facilities
of
diverse
platforms.
F
So,
for
example,
it
can
handle
the
complexities
of
storing
private
keys
in
trusted
platform
modules
or
secure
elements
and
any,
and
it
can
give
us
uniform,
simplified
interfaces
to
do
those
things
in
our
preferred
programming
languages,
and-
and
this
is
so
that
applications
can
get
access
to
those
best
available
hardware,
security
facilities
in
a
decoupled
way,
so
keeping
them
fully
architecture,
agnostic
and
platform
agnostic.
So
that's
what
parsec
is
now
the
slide
here
that
has
put
up,
so
this
is
showing
us
how
parsec
can
make
use
of
spiffy
identities.
F
F
So
it
can
isolate
these
different
client
applications
from
one
another
so
that
they
can
share
the
hardware,
but
they
can't
perform
operations
with
each
other's
keys,
for
example.
So
the
diagram
on
screen
summarizes
how
pass
that
can
do
this
with
spiffy
identities.
So
it
shows
this
this
triangular
three-way
interaction
between
the
application,
the
parsec
service
and
the
spire
service
along
the
local
machine.
F
So
so
parsec
knows,
but
by
this
this
three-way
circuit
that
each
api
call
it
receives
is
coming
from
a
client
workload
with
a
proven
identity
and
it
can
commit.
It
can
then
start
permitting
access
to
keys
on
the
on
the
basis
of
that
identity,
and
the
really
great
news
is
is
that
this
is
an
integration
that
we've
we've
largely
completed.
F
So
it's
still
work
in
progress.
So
it's
in
the
process
of
being
upstreamed
in
into
parsec.
Now,
we've
done
a
bit
of
community
enrichment
around
this
as
well.
So
there
is
a
rust
spiffy
library,
because
parsley
is
a
rust
project.
There
is
a
rust,
spiffy,
parsec
library
that
already
existed
in
community,
but
we've
done
some
enrichment
on
that.
F
As
part
of
this
work,
there's
a
lightning
talk
taking
place
later
today,
that's
as
part
of
cloud
native
security
day
where
andres
and
I
show
a
demo
of
this
in
action-
it's
pretty
cool.
We
take
it
at
a
thousand
miles
an
hour,
because
it's
only
a
lightning
talk,
but
do
look
out
for
that.
Maybe
catch
the
recording
and
also,
if
you
have
questions
for
me,
either
about
this
integration
or
about
parsec.
F
Generally,
which
I've
I've
really
only
given
the
merest
hint
of
what
it
is
really
you
can
find
me
on
the
cncf
and
the
spiffy
slack
workspaces,
there's
also
a
parsec
channel
on
the
cncf
slack.
You
can
come
and
engage
with
the
entire
parsec
community
as
a
whole
there,
and
and
that's
it
really
so
yeah.
Let
me
let
me
just
say
thanks
once
again
and
head
back
and
hand
back
to
you,
so
thanks
very
much.