Senior LevelAuthentication & Authorization
How do SPIFFE / SPIRE establish Workload Identity in cloud-native Kubernetes clusters?
❓ Interview Prompt: Explain SPIFFE ID URIs, SVID X.509/JWT credentials, SPIRE Workload Attestors (cgroups, k8s), and secretless mTLS.
In microservice and container environments, workloads need to authenticate to each other without hardcoding secret passwords or API keys in code repository configs. SPIFFE/SPIRE provides Secretless Workload Identity.
SPIFFE Architecture:
1
SPIFFE ID: A standardized URI representing a workload identity ('spiffe://cluster.local/ns/prod/sa/billing-service').
2
SVID (SPIFFE Verifiable Identity Document): Short-lived X.509 certificates or JWTs containing the SPIFFE ID issued automatically to containers.
3
SPIRE Attestation: The SPIRE Agent runs on the host node, inspecting local kernel cgroups, process IDs, and Kubernetes Service Account tokens (Attestation) to verify workload identity before issuing SVIDs.
4
Secretless mTLS: Microservices use short-lived SVIDs to establish mTLS channels without managing static secrets!
Code Implementation Example
typescript
import { WorkloadApiClient } from '@spiffe/spiffe-id';
// Fetching short-lived SVID X.509 certificate directly from local SPIRE Agent socket
async function fetchSpiffeWorkloadIdentity() {
const client = new WorkloadApiClient({ socketPath: '/tmp/spire-agent/public/api.sock' });
const x509Svid = await client.fetchX509Svid();
console.log('SPIFFE ID:', x509Svid.spiffeId); // "spiffe://cluster.local/ns/prod/sa/billing"
return { cert: x509Svid.certificatePem, privateKey: x509Svid.privateKeyPem };
}💡Fetching short-lived SPIFFE SVID X.509 certificate from local SPIRE agent unix socket.
🎯 Interview Key Takeaway
SPIFFE/SPIRE attests container workloads and issues short-lived SVID X.509 certificates for secretless microservice mTLS.
#SPIFFE#SPIRE#Workload Identity#Kubernetes#Senior
Back to all Authentication & Authorization Questions→