SPIFFE

SPIFFE is a set of standards for giving workloads a short-lived, cryptographically verifiable identity without pre-distributing secrets.

• Category: Identity & Policy
• CNCF maturity: Graduated
• Language: Go
• License: Apache-2.0
• Repository: spiffe/go-spiffe
• Documented at commit: e9973f6 (v2.8.1)

What it is

SPIFFE (Secure Production Identity Framework For Everyone) is a vendor-neutral set of standards for workload identity. It defines three things: the SPIFFE ID (a spiffe:// URI that names a workload), the SVID (an X509-SVID or JWT-SVID, the verifiable identity document), and the Workload API (a gRPC API that issues and rotates SVIDs). The reference server and agent that implement those standards live in a separate project, SPIRE.

This deep-dive reads spiffe/go-spiffe, the canonical Go client library applications use to consume SPIFFE. It wraps the Workload API and gives you mutually authenticated TLS between workloads, X509-SVID and JWT-SVID retrieval and validation, and trust bundle management (README.md:5-9).

A workload never sees a long-lived credential. It connects to a local Workload API endpoint (a SPIRE Agent over a Unix socket), the agent attests the workload, and go-spiffe streams freshly minted SVIDs into the application's TLS config. Identity is the URI in the certificate, and authorization is checking that URI against an allowed set.

When to use it

• You run services across clusters, clouds, or VMs and want one identity model instead of per-platform IAM.
• You want mTLS between services where the peer's identity is a spiffe:// URI, not a hostname or a shared token.
• You need to federate trust between separate trust domains so workloads in one can authenticate workloads in another.
• It is a poor fit if you only need human or end-user authentication; SPIFFE identifies workloads, not people.
• It adds operational weight if you have a single platform whose native workload identity (for example a cloud IAM) already covers your needs.

In this deep-dive

• History: origin, milestones, and why it exists.
• Architecture: components and how requests flow.
• Adoption & Ecosystem: who runs it and what surrounds it.
• Internals: the code paths that matter, read from source.
• Getting Started: install and a first working setup.

Sources

1. spiffe/go-spiffe repository (pinned v2.8.1).
2. SPIFFE and SPIRE Projects Graduate from CNCF.
3. SPIFFE project page (CNCF).
4. SPIFFE standards (SPIFFE-ID / SVID / Workload API).
5. spiffe.io and SPIRE case studies.
6. Uber: Our Journey Adopting SPIFFE/SPIRE at Scale.
7. spiffe/spire ADOPTERS.md.
8. go-spiffe v2 Go package reference.