SPIFFE, the Secure Production Identity Framework for Everyone, is a set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments. Systems that adopt SPIFFE can easily and reliably mutually authenticate wherever they are running.

Distributed design patterns and practices such as micro-services, container orchestrators, and cloud computing have led to production environments that are increasingly dynamic and heterogeneous. Conventional security practices (such as network policies that only allow traffic between particular IP addresses) struggle to scale under this complexity. A first-class identity framework for workloads in an organization becomes necessary.

Further, modern developers are expected to understand and play a role in how applications are deployed and managed in production environments. Operations teams require deeper visibility into the applications they are managing. As we move to a more evolved security stance, we must offer better tools to both teams so they can play an active role in building secure, distributed applications.

SPIFFE is a set of open-source specifications for a framework capable of bootstrapping and issuing identity to services across heterogeneous environments and organizational boundaries. The heart of these specifications is the one that defines short lived cryptographic identity documents – called SVIDs via a simple API. Workloads can then use these identity documents when authenticating to other workloads, for example by establishing a TLS connection or by signing and verifying a JWT token.

You can read more about how the SPIFFE APIs are defined and used in the Concepts guide.

Which tools implement SPIFFE?

The following tools implement some or all of the SPIFFE specification, and issue SPIFFE IDs:

The SPIRE project

SPIRE is an open-source toolchain that implements the SPIFFE specification in a wide variety of environments Read more

Istio

The Istio control plane issues SPIFFE IDs for all workloads Read more

HashiCorp Consul

The Consul Connect service mesh uses the SPIFFE specification for establishing service identities, enabling Consul Connect services to connect with other SPIFFE-compliant systems Read more

Kuma

Kuma automatically generates SPIFFE-compatible certificates that identify all the services and workloads running in the service mesh, and encrypts all the traffic generated between them Read more

cert-manager CSI driver

csi-driver-spiffe is a cert-manager project that delivers SPIFFE compliant X.509-SVIDs to Kubernetes Pods using CSI, based on the identity of the mounting ServiceAccount. Read more

Which tools work with SPIFFE?

The following tools include built-in integrations to consume SPIFFE IDs:

The Envoy proxy

Customers can use SPIFFE IDs to establish mTLS connections between Envoy proxies Read more

Pinterest Knox

Customers can authenticate to Knox with SPIFFE IDs Read more

The Ghostunnel proxy

Customers can use SPIFFE IDs to establish mTLS connections between Ghostunnel proxies with built-in support for obtaining X.509-SVID identities via the SPIFFE Workload API Read more