SPIFFE / SPIRE Workload Identity

Attestation and SVID issuance, then peer verification for mutual identity

SPIFFE / SPIRE Workload Identity Attestation and SVID issuance, then peer verification for mutual identity request SVID attest workload issue SVID (X.509) deliver SVID call + present SVID fetch trust bundle trust bundle verified: mTLS up Issue SVID Verify peer Workload A · needs identity · Sequence participant Workload A needs identity SPIRE Agent · node-local · Sequence participant SPIRE Agent node-local SPIRE Server · trust root · Sequence participant SPIRE Server trust root Peer Service · verifier · Sequence participant Peer Service verifier Legend request return security async trace

Attestation

  • • The agent proves the workload's node identity
  • • The server issues a short-lived X.509 SVID
  • • Identity is delivered without shipping secrets

Verification

  • • The peer fetches the shared trust bundle
  • • It verifies the SVID against the trust root
  • • Both sides now hold provable identity

Mutual Identity

  • • No static credentials are exchanged
  • • SVIDs rotate automatically
  • • The result is workload-to-workload mTLS

Sequence diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export