Tag feed

#spiffe

14 posts0 followers

Explore Hashnode

Alternatives

Trending tags this week

KBKenneth Binghamblog.openziti.ioMar 23 · 5 min read

Using SPIRE as a Trusted Authority for OpenZiti Identities

Introduction Identity management is central to modern network security. This post shows how to use short‑lived X.509 client certificates from SPIRE — the reference runtime for SPIFFE (Secure Productio

0

IIAMDevBoxiamdevbox.hashnode.devMar 22 · 7 min read

IETF AIMS: How AI Agents Authenticate with SPIFFE and OAuth 2.0

On March 2, 2026, four engineers from Defakto Security, AWS, Zscaler, and Ping Identity published draft-klrc-aiagent-auth-00 — a 26-page IETF draft that finally gives AI agents a proper identity framework. Called AIMS (Agent Identity Management Syste...

0

CAChris Adkinagentops.hashnode.devFeb 21 · 13 min read

Taming Rogue Agents: Defeating ASI03 with SPIFFE Identity Federation

This post follows on from the previous post in the series: Taming Rogue Agents: Defeating ASI03 with Vault Dynamic Secrets. The Foundation: Mitigating ASI03 The previous post in this series demonstrat

0

JGJoe Garciajoegarcia.devDec 10, 2025 · 4 min read

Why Workload Identity Is Hard to Explain (And How I Tried to Fix It)

I've spent a lot of time explaining workload identity to people. Like, a lot. And I've watched a lot of eyes glaze over. It's not that people aren't smart. It's that when you explain something they already know, like a database or a container or what...

0

ACAman Choudharycaman.hashnode.devJun 17, 2025 · 4 min read

No More Secrets: How I Built a Zero-Trust CI/CD Pipeline with GitHub Actions, Vault, and SPIRE

Let’s be honest: most CI/CD pipelines today are still scary from a security perspective. I've seen access keys buried in YAML, secrets passed as plaintext env vars, and vault tokens that never expire. In an age of cloud-native infrastructure and Zero...

0

SRSrujan Reddysrujanpakanati.comApr 30, 2024 · 3 min read

Understanding Zero Trust Networks, mTLS and SPIFFE

Need for ZTN Firstly, Zero Trust Network is where no network entity is trusted by default or with respect to its position in the network. Every workload, node, machine needs to continuously identify itself. Shortcomings of traditional network archite...

0

崔崔秀龙blog.fleeto.usDec 17, 2022 · 2 min read

在 Spire 中用 Ssh 证实节点身份

前面关于 SPIRE 的内容中，介绍了使用 JOIN Token 证实节点身份的方法。这种方法比较简易，但是完全依赖 SPIRE Server/Agent 的“内循环”，并不利于外部管理，同时每次节点更新，都要照本宣科的重来一遍。对于动态集群来说，这种方式并不理想，SPIRE 包含了面向 OpenStack、几大公有云以及 TPM 等的花钱证实节点身份的方案；除了这些之外，还有个经济型的证实方法——使用 SSH。我们一般使用的免密登录 SSH 方案通常是点对点的，总结来说就是服务器和客户端各自...

0

崔崔秀龙blog.fleeto.usNov 24, 2022 · 4 min read

用 SPIRE 为 Pod 提供身份

开始之前 SPIFFE 是一个认证框架，能为多种节点和工作负载类型提供证实能力，解决“我是我”的问题，前面文章演示过用 SPIRE 给类 Unix 进程提供身份的方法，今天这篇就试试给 Pod 提供身份。这次实验会在前面的基础之上，在 Kubernetes 集群之外运行独立的 SPIRE Server，在集群中用 Pod 的形式运行 SPIRE Agent 作为节点，最后在其它 Pod 中访问 SPIRE Agent，获取 SVID。本文所涉及的对象关系如下图所示：开始之前，需要做一些准备...

0

崔崔秀龙blog.fleeto.usNov 24, 2022 · 3 min read

Scaling Spire.md

原文：Scaling SPIRE SPIRE 的容量是有限的，随着工作负载强度的不同，需要有不同的规模。一套 SPIRE 中的 Server 部分，可能由一或多个共享数据存储的 SPIRE Server 组成；还可以是同一信任域的多个 SPIRE Server；至少有一个 SPIRE Agent，当然，多数时候是多个 Agent。部署规模和负载规模相关。单个 SPIRE Server 能够承载一定数量的 Agent 和注册项。SPIRE Server 负责管理和签发注册项的身份，因此它的内存和...

0

崔崔秀龙blog.fleeto.usOct 22, 2022 · 4 min read

用 Ghostunnel 和 SPIRE 为 NGINX 提供 SPIFFE 认证

之前对 SPIFFE 和 SPIRE 进行了一个相对全面/啰嗦的介绍，这一篇就反过来，用一个简单的例子来展示 SPIRE 的基本用法，本文中会以 NGINX 作为服务生产方，使用 Ghostunnel 当做 NGINX 的反向代理，把原有的 HTTP 通信升级为支持定期正顺轮转的双向 TLS 认证协议，并且用 CURL 使用客户端证书来通过 Ghostunnel 安全地访问背后的 NGINX。这里为 CURL 和 NGINX 提供证书以及轮转的，就是 SPIRE 的 Server 和 Agent...

0

#spiffe

Search Hashnode

#spiffe

Explore Hashnode

Trending tags this week

Using SPIRE as a Trusted Authority for OpenZiti Identities

IETF AIMS: How AI Agents Authenticate with SPIFFE and OAuth 2.0

Taming Rogue Agents: Defeating ASI03 with SPIFFE Identity Federation

Why Workload Identity Is Hard to Explain (And How I Tried to Fix It)

No More Secrets: How I Built a Zero-Trust CI/CD Pipeline with GitHub Actions, Vault, and SPIRE

Understanding Zero Trust Networks, mTLS and SPIFFE

在 Spire 中用 Ssh 证实节点身份

用 SPIRE 为 Pod 提供身份

Scaling Spire.md

用 Ghostunnel 和 SPIRE 为 NGINX 提供 SPIFFE 认证