Cryptographic Workload Attestation with SPIFFE & SPIRE

The Problem of Workload Identity

In microservice architectures, services must prove their identity to one another. Historically, developers embedded static API tokens, private keys, or passwords inside configuration files or Kubernetes secrets. If a single pod is compromised, the attacker exfiltrates these credentials and moves laterally across the infrastructure.

SPIFFE (Secure Production Identity Framework for Everyone) and SPIRE solve this by establishing secretless, kernel-verified cryptographic workload attestation.

Core Concepts

• SPIFFE ID: A standardized URI uniquely identifying a workload: spiffe://tinycto.tv/ns/production/sa/payment-service
• SVID (SPIFFE Verifiable Identity Document): A cryptographically signed document (typically an X.509 certificate) with a short lifetime (e.g. 1 hour).
• SPIRE Agent: A node-level daemon that verifies local workloads via the Linux kernel (/proc) before issuing SVIDs.
• SPIRE Server: The CA that manages the trust domain, issues trust bundles, and signs SVIDs.

Node & Workload Attestation Flow

1. Node Attestation: The SPIRE Agent boots on a host and proves its identity to the SPIRE Server using platform primitives (TPM 2.0, AWS Instance Identity Document, or GCP Token).
2. Workload Registration: Operators register selectors that define what constitutes a valid service (e.g., k8s:ns:production, k8s:sa:payment-service, docker:image_id:sha256:...).
3. Workload Attestation: When the payment pod initiates a connection to the SPIRE Agent Workload API over a Unix Domain Socket (/run/spire/sockets/agent.sock), the Agent calls the Linux kernel to inspect the caller's process ID (SO_PEERCRED).
4. Issuance: The Agent dynamically injects a short-lived X.509 SVID directly into the process memory. No private keys are ever stored on disk.

[ Workload Pod ] ──(Unix Domain Socket)──> [ SPIRE Agent ] ──(mTLS)──> [ SPIRE Server (Root CA) ]
      ▲                                         │
      └────── In-Memory X.509 SVID Injection ───┘

Verification CLI

# Inspect ephemeral SVID issued to the local payment service
kubectl exec -n production deploy/payment-service -c payment -- \
  spire-agent api fetch x509 -write /tmp/svids/
openssl x509 -in /tmp/svids/svid.0.pem -text -noout | grep -E "Subject:|Validity|URI:"