Cloud Native Night, February 2018, Munich: Talk by Andrew Jessup (@whenfalse, co-founder of & Head of Product at Skytale) Join our Meetup: https://www.meetup.com/de-DE/cloud-native-muc/ Abstract: This talk gives an overview of the motivation and design of the SPIFFE and SPIRE projects, which provide an open standard and toolchain for trusted communication in modern cloud computing environments, and how they are being used as a foundation for other infrastructure tools including Hashicorp Vault, Lyft's Envoy and the Istio project.

1. Building Trust Between Modern Distributed
Systems with SPIFFE
Andrew Jessup, Scytale Inc.

2. Source Workload
Destination
Workload
“Do I believe this workload is who they
say they are?”
“Do I believe they really sent that
message?”

3. Mobile API Web Front End POS API
TicketsSubscriptions
Billing
Members DB

4. Web Front End Subscriptions
4. Acknowledge
* Or key/secret, signed nonce etc.
2. Supply username and password*
with authentication handshake
Accounts
1. Retrieve
username and
password from
configuration
Model 1: Destination workload
authentication
3. Verify
username
and
password
?
?
Source workload Destination
workload

5. Model 2: Platform mediated identity
Web Front End Subscriptions
4. Acknowledge
2. Send proof of identity with
authentication handshake
1. Retrieve
proof-of-identity from
the platform
3. Verify source
workload
identity
Platform (eg. AWS, or Kubernetes)
Eg. AWS IAM, Kubernetes Service Accounts
Privaliged API Privaliged API
Source workload
Destination
workload

6. Destination
workload
authentication
Platform mediated
identity
SPIFFE
API-driven credential
rotation and
distribution
No Yes Yes
One identity per
workload
No Yes Yes
No credentials need
to be deployed with
the workload
No Yes Yes
Supports trust across
different platforms
platforms
Yes No Yes

7. Platform B
Secure Production Identity Framework For
Everyone
Web Front End Subscriptions
4. Acknowledge
1. Retrieve SPIFFE ID
and SVIDs from the
worklaod API
3. Verify source
workload
identity
Platform A
Workload API Workload API
2. Send proof of identity with
authentication handshake

9. Dave Presotto
2004
Russ Cox
2008
Eric Grosse
2007
Rob Pike
2002
Sean Quinlan
2002

10. The SPIFFE project
A set of specifications that cover how a workload should
retrieve and use it’s identity.
● SPIFFE ID
● SPIFFE Verifiable Identity Documents (SVIDs)
● The SPIFFE Workload API
The SPIFFE Runtime Environment. Open-source software
that implements the SPIFFE Workload API for a variety of
platforms.
Apache 2.0 license. Independent governance. Highly
extensible through plug-ins.
github.com/spiffe/spiffe
github.com/spiffe/spire

11. SPIFFE ID
spiffe://acme.com/billing/payments
Trust Domain Workload Identifier

12. SPIFFE Verifiable Identity Document
spiffe://acme.com/billing/payments
Today only one form of SVID (X509-SVID).
Other document types under consideration
(including JWT-SVID)
Typically short-lived

13. Server
SPIFFE Workload API
Workload
Workload API
whoami()
Workload
whoami()

14. SPIFFE Integrations so far
A Go client library for parsing SVIDs (github.com/spiffe/go-spiffe)
Using SVIDs to authenticate Ghost-tunnel proxies
https://blog.scytale.io/securing-the-service-mesh-with-spire-0-3-38775f767653
Using SVIDs to authenticate Envoy proxies
https://blog.scytale.io/securing-the-service-mesh-with-spire-0-3-38775f767653
In development:
● A C client library for parsing SVIDs (github.com/spiffe/c-spiffe)
● Using SVIDs to authenticate gRPC clients (w. Google)
● Using SVIDs as an authentication backend to Vault (w. QAware, Hashicorp and Redhat)
● Using SVIDs to authenticate to nginx (Scytale)

15. SPIFFE Runtime Environment
SPIRE Server
spiffe://acme.com/billing/payments
selector: aws:sg:sg-edcd9784
selector: unix:uid:1001

16. Node attestation
EC2 Instance
Workload
SPIRE Agent
Workload API
SPIRE Server
AWSInstance
MetadataAPI
1. Node agent authenticates to the SPIRE
Server, passes AWS Instance Identity
Document

17. Node attestation
EC2 Instance
Workload
SPIRE Agent
Workload API
SPIRE Server
2. List of valid SPIFFE IDs for the node, and
selectors, returned

18. Workload attestation
EC2 Instance
Workload
SPIRE Agent
Workload API
SPIRE Server
3. Workload requests identity
4. Node agent performs an out-of-band
check of the workload process metadata,
compares to known selectorswhoami()

19. SVID Bundle Issuance
EC2 Instance
Workload
SPIRE Agent
Workload API
SPIRE Server
5. If match found, NA generates a key for
the workload
6. NA sends certificate signing request
based on that key to SPIRE Server

20. SVID Bundle Issuance
EC2 Instance
Workload
SPIRE Agent
Workload API
SPIRE Server
6. SPIRE server issues SVID (as well as
certificates for any other workload the
instance should support)

21. SVID Bundle Issuance
EC2 Instance
Workload
SPIRE Agent
Workload API
SPIRE Server
7. Certificate bundle returned to the
workload

22. SPIFFE Runtime Environment
SPIRE Server
spiffe://acme.com/billing/payments
selector: aws:sg:sg-edcd9784
selector: k8s:ns:payments
selector: k8s:sa:pay-svc
selector: docker:image-id:442ca9

23. SPIRE
Workload Attestor Plug-ins Node Attestor Plug-ins
Workload API
Secure Introduction to other services
mTLS JWTs
Identity for proxy services
Linux
Windows
OS X
YubiKey
HSM providersAzure
GCP
Kubernetes
Mesosphere Join Token
AWS Kerberos
Simplify deployment of
distributed systems
CoreWorkloadPlatform
gRPC

24. What SPIFFE is not
● Authorization (however it provides identities upon which
authorization schemes can be deployed)
● Transport level security (however SVIDs can be used to
facilitate things like TLS or JWT signing)

25. Things we didn’t talk about
● Integration into custom datastores and PKI
● Design patterns (secure introduction to secrets stores,
service mesh, etc.)
● Identity translation
● Federation

26. Where to go next
● Github!
○ github.com/spiffe/spiffe
○ github.com/spiffe/spire
○ github.com/spiffe-example
● Evan Gillman’s KubeCon 2017 talk on SPIFFE (YouTube)
● Medium - https://blog.scytale.com/
● Join our next community day (March 9, daytime PST) or
meet us at KubeCon EU 2018 in Copenhagen
Pointers to SIGs, Slack,
mailing lists and more

27. Thank You! Andrew Jessup
Twitter: @whenfalse