SPIFFE
A standard for naming workloads and giving each one a verifiable identity document, written as a URI such as spiffe://cluster.local/ns/payments/sa/default.
In more detail
A service mesh such as Istio issues every workload a certificate carrying its SPIFFE ID, built from the namespace and service account. Peers check that identity during mutual TLS instead of trusting an IP address. Authorization policies can then say which identity may call which service.
Related terms
- mutual TLS — TLS in which both sides present certificates, so the server also proves who the client is.
- service mesh — A layer of proxies alongside every service that handles traffic between services: routing, retries, TLS and telemetry.
- Istio — An open-source service mesh for Kubernetes that adds a proxy beside each pod to encrypt, authenticate and control traffic between services.
Taught in
- Four Alerts, One Incident: Observability And The Mesh — Kubernetes and Cloud Native Security Associate (KCSA) Exam Prep