►
From YouTube: Keynote: Creating with Authenticity & Humility: A SPIFFE Origin Story - Sunil James, HPE
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: Creating with Authenticity & Humility: A SPIFFE Origin Story - Sunil James, HPE
Five years ago, a public Google document proselytized the reasons for SPIFFE's existence. This document, and the people involved in its creation, began a movement that brought together people who contemplated how to tackle a myriad of security challenges as they and their organization move "into the cloud." However, this document didn't start from thin air. Like most great efforts, SPIFFE stands on the shoulders of its predecessors, and moves forward because of those who carry our story into the future. This presentation explores and celebrates the SPIFFE community: a band of authentic and humble engineers, product managers, UI/UX designers, documentation writers, marketers, and more.
A
I
am
with
hpe,
but
my
story
with
spiffy
starts
well
before
hpe
and
it's
been
a
minute
since
I've
been
really
involved
in
these
types
of
activities.
I
used
to
early
on
be
the
emcee
these
kinds
of
events
and
trying
to
figure
out
how
you
get
people
to
show
up
to
a
little
project
when
nobody
understands
what
we're
talking
about
and
why
they
should
care,
and
it's
it's
amazing,
to
see
the
growth
in
the
community.
It's
amazing
to
see
all
the
contributions,
it's
amazing
to
see
people's
continued
investment
in
this
project.
A
So
thank
you
for
that
today,
I'm
going
to
take
you
very
quickly
through
a
story,
at
least
in
terms
of
the
the
genesis
of
this
project.
This
will
be
old
news
for
some
of
the
folks
in
this
room
already
that
have
been
there
with
me,
but
for
many
of
you
it'll
be
probably
brand
new,
so
hopefully
this
will
give
you
a
sense
of
where
we've
come
from
and
where
we're
going
and
the
things
that
I
think
are
important
to
what
this
community
is
all
about.
A
at
16
I
was
at
a
firm
called
bessemer.
It
was
an
investment
firm.
We
did
a
lot
of
venture
capital
investments
and
before
that
I
was
at
google,
I
worked
as
a
product
manager
in
the
networking
group
for
google
cloud
and
I
spent
a
lot
of
time
working
on
some
of
the
networking
services
that
google
cloud
eventually
launched
and
developed.
A
While
at
google
I
had
an
opportunity
to
meet
this
guy
and
he
didn't
look
as
crazy
as
he
does
in
this
picture,
but
he
was
crazy
in
so
many
good
ways,
right
and
in
the
good
ways
that
I
think
we
all
benefit
from
our
industries
benefit
from
as
well
him
craig,
I'm
forgetting
he's.
Gonna
kill
me
now.
Well,
the
founders
of
kubernetes,
among
others,
spent
a
lot
of
time.
A
Thinking
about
how
do
you
bring
to
life
concepts
around
distributed
systems,
architecture
for
everybody
that
doesn't
have
a
name
that
sounds
like
google
right
and
one
of
those
was
spiffy?
Okay.
So
back
in
2016,
for
those
of
you
that
didn't
know,
joe
betta
was
one
of
the
folks
that
wrote
the
first.
He
drafted
the
first
document,
this
google
document
that
was
circulated
amongst
a
small
group
of
people
in
2016.,
okay-
and
I
was
one
of
those
folks
that
got
this
document
and
I
was
reading
through
it
and
having
been
a
googler.
A
I
I
saw
some
of
the
power
of
the
technology
that
was
underpinning
this
and
what
was
based
on
this
and-
and
this
became
the
beginnings
of
of
what
I
think
is
an
amazing
project
that
provides
a
pretty
foundational
and
required
capability
to
continue
to
build
the
architectures
that
you
see
being
discussed
at
conferences
like
this.
This
technology
was
built
on
top
of
something
inside
of
google
called
low
s
low
overhead
authentication
system.
A
That's
out
there,
you've
seen
at
different
production,
identity
days
and
different
meetups
umer,
and
you
know
evan
and
others
have
used
terms
like
dial
tone
that
term
originated
inside
of
google
when
they
described
the
capability.
Like
this
as
dial
tone
right,
you
don't
have
to
think
about
how
I'm
going
to
wire
up
my
applications
to
talk
to
each
other.
They
basically
have
a
registry,
they
have,
you
know,
kind
of
attested
identities
and
then,
when
we
need
to
communicate,
we
have
to
communicate
over.
You
know
authenticated
encrypted
jrpc
channels
as
well.
A
They
also
went
off
and
tried
to
do
all
types
of
static,
token
and
key
injection
into
various
systems
and
servers
all
their
machines
that
were
out
there,
but
those
two
had
all
kinds
of
constraints
in
the
sense
that
they
were
tied
to
the
machines
they
weren't
necessarily
tied
to
the
ephemeral
workloads
per
se.
So
there
was
a
gap
that
existed
in
terms
of
the
ability
to
be
able
to
scalably
provision
and
de-provision
these
identities
throughout
google's
infrastructure.
A
A
In
fact,
totem
began
to
exhibit
many
of
the
characteristics
of
being
able
to
have
a
decentralized
way
of
being
able
to
continuously
provide
some
level
of
verification
for
every
file.
That
was
communicating
with
every
other
file
in
the
unix-based
distributed
operating
system,
and
so
it's
no
surprise
that
you
know,
as
google
thought
about
its
challenges
and
where
it
was
going
to
go
as
it
continued
to
scale
that
the
authors
of
this
paper,
russ
cox,
eric
gross
or
pike
de
prisano,
sean
quinlan,
they
all
found
their
way
over
to
google.
A
So
this
is
by
no
mistake
right.
These
ideas
come
from
looking
at
what
we've
done
beforehand
and
I
think
in
some
ways
what
you're,
seeing
with
low
ass
and
alts
is,
or
was
one
of
the
first
production
implementations
of
some
of
these
crazy
ideas
by
these
crazy
computer
scientists,
who
we
all
have
lots
to
give
thanks
for.
So
that
became
the
backstory
for
how
and
why
we
decided
to
actually
or
why
joe
decided
to
bring
this
idea
out
into
the
world
and
then
bring
a
group
of
people
around
him,
including
myself.
A
In
2016.
We
went
forward
and
we
continued
to
build
a
small
community.
Okay,
and
it
was
myself
joe
and
a
number
of
folks
in
this
room
in
the
early
days
in
2016
that
you'll
see.
This
includes
folks
from
google
on
the
istio
team,
cisco
or
before
it
was
istio,
cisco,
netflix,
twilio,
salesforce,
twitter
and
jp
morgan
chase.
A
This
was
spiffy
meetup
number
one
at
twilio,
or
at
netflix's
hq
down
in
los
gatos
california,
small
group,
seven
people,
eight
people
very
different
than
what
we
have
here
today
and
I'm
very
grateful
for
that,
because
it
meant
that
we
were
doing
something
right.
We
were
thinking
about
this
the
right
way.
This
became
the
beginnings
of
our
little
community
right
and
it
went
so
far
to
eventually
have
me
decide
to
go
form
a
company
called
saitail,
which
many
of
you
know.
A
Many
of
you
were
part
of
sidetail
as
well,
and
this
became
the
company
that
was
really
materially
driving
a
lot
of
the
engagement
from
2017
and
on.
In
fact,
when
we
started
seitel
in
q1
of
2017,
we
were
still
talking
about
spiffy
inspire.
We
had
barely
gotten
a
sense
of
what
it
was.
No
code
had
been
written
at
this
point.
A
This
was
huge
for
our
community
right,
huge
for
a
group
of
seven
eight
people
sitting
in
a
room
together
and
all
of
a
sudden
google
gets
up
on
stage
and
talks
about
this
project.
That's
barely
off
the
ground
and
running,
and
that
was
really,
I
think
what
kicked
things
off
for
us
as
we
continued
forward
in
time.
We
eventually
got
to
the
point
where
we
got
a
group
of
folks
together,
and
we
made
our
submission
in
november
of
2017
to
the
cncf.
A
It
was
a
long
process.
It
was
a
very
different
process
than
I
understand
it
is
today,
which
is
a
sign
of
the
growth
and
and
prosperity
of
the
cnc
and
the
open
source
community
as
a
whole,
but
this
became
kind
of
the
watershed
moment
for
our
project
or
one
of
the
watershed
moments
for
our
project,
because
it
allowed
for
us
to
actually
go
forward
from
being
an
idea
to
being
something
that
had
the
backing
of
an
organization
that
had
the
kind
of
principles
that
we
also
espouse
in
our
community
as
well.
A
A
It
was
a
great
great
conference
for
us.
It
was
a
great
party
for
us
because
there's
an
opportunity
for
everybody
to
understand
a
little
more
about
who
and
what
we
were
and
that
eventually,
a
few
months
later
led
to
the
cncf
hosting
our
spiffy
project.
Now
this
is
our
story.
This
is
our
origin
story
for
our
project
right,
but
our
story
is
built
on
the
stories
of
others,
those
of
you
that
are
here
in
this
community
now.
A
A
That
doesn't
take
no
for
an
answer
which
I
love,
and
I
think
that
is
what
drives
us
forward
and
is
what
has
allowed
for
this
community
to
continue
to
thrive
and
grow
in
the
way
that
it
has
over
the
last
four
years
and
as
you
continue
to
be
engaged
in
this
community,
we
expect
I
expect
you
to
be
the
same.
I
expect
you
to
say
I
don't
know
how
to
do
things.
I
expect
you
to
say
I
need
help
with
things,
because
that's
what
this
community
is
designed
to
do.
A
It
is
not
one
where
everybody
just
knows
what's
happening
if
it
was,
this
would
have
been
said
and
done
a
long
time
ago,
engage
participate,
offer
be
vulnerable
in
this
community
because
it's
a
community
that
will
will
honor
that
and
we'll
respect
that
very,
very
much
so
so
with
that
I'll
say.
Thank
you
for
your
time.
Thank
you
for
commitment.
If
you
want
to
connect
with
me,
that's
my
qr
code
for
those
of
you
at
home
as
well.
You
can
just
scan
that
and
I'll
see
you
on
linkedin
all
right.
Thank
you.