SPIFFE: Zero Trust Workload Identification with Evan Gilman

Modern software consists of sprawling international networks of servers.

Users contact these servers to access applications. Microservices talk to each other to fulfill complicated requests. Databases and machine learning frameworks crunch terabytes of information to provide complicated answers. Across this infrastructure, there is a lot of different activities–and a lot of vulnerabilities. Without a reliable model for security and trust, software can be easily compromised.

In the past, systems were often protected by a “firewall”, which is a security system around the perimeter of the network. A problem with this model is that if the attacker is able to penetrate the firewall, they can compromise anywhere in the network. Firewalls can be penetrated, so a much better security model is to assume that your network has already been compromised, and to require every internal system to identify and authenticate with each other.

“Zero-trust security” is a security model that requires internal systems to communicate with each other as if they were potentially compromised. Evan Gilman is the author of Zero Trust Networks: Building Secure Systems in Untrusted Networks. He also works on SPIFFE, a system for managing identity and trust within a zero-trust network.

In a previous episode about Google BeyondCorp, Max Saltonstall talked about zero-trust networking in the context of user and device authentication. In today’s episode, Evan discusses another side of zero-trust networking: workload identity and authentication. Just as Google BeyondCorp outlines an architecture for allowing devices to communicate with the network, the SPIFFE project outlines a system for workloads to identify and authenticate themselves. Workloads can range from MapReduce jobs to microservices to frontend application servers.


Mesosphere’s Kubernetes-as-a-service provides single-click Kubernetes deployment with simple management, security features, and high availability to make your Kubernetes deployment easy. To find out how Mesosphere Kubernetes-as-a-Service can help you easily deploy Kubernetes, check out softwareengineeringdaily.com/mesosphere today.

Fission is an open-source, Kubernetes-native, Serverless framework. Fission allows you to easily code serverless functions in any language, and have them run wherever you have a Kubernetes cluster – be it in the public cloud, in your own datacenter, or even on your laptop. To learn more about Fission and to try it out, go to fission.io.

Transifex is a SaaS-based localization and translation platform that easily integrates with your agile development process. If you’re a developer who is ready to reach a global audience, check out Transifex by visiting transifex.com/sedaily and sign up for a free 15-day trial.

Get ready to build content-rich websites and professional web applications with Wix Code. Store and manage unlimited data with built-in databases, create dynamic pages, make custom forms and take full control of your site’s functionality with Wix Code APIs and JavaScript. Plus, now you can get 10-percent off your Premium plan. Go to Wix.com/SED.

Software Weekly

Software Weekly

Subscribe to Software Weekly, a curated weekly newsletter featuring the best and newest from the software engineering community.