SPIFFE
Secure Production Identity Framework for Everyone. A CNCF-graduated specification for workload identity. SPIFFE IDs are URI-like identifiers; SVIDs are the cryptographic credentials (x509 or JWT) that prove a workload owns its ID.
SPIFFE matters because it gives workloads an identity the platform attests, rather than a secret someone provisioned, which removes the credential from the threat model entirely. The identity is derived from where and what the workload is, and the SVID is short-lived by design. It is the cleanest available answer to service-to-service authentication in Kubernetes and multi-cloud estates.
See also: workload identity, mTLS, what is machine identity, machine identity vendors
Related on Start with Identity
- GlossaryNon-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most
- GlossaryService Principal
A service principal is the identity an application or automated workload uses to sign in to Microsoft Entra ID and access Azure or Microsoft Graph resources: th
- GlossaryWorkload Identity Federation
Workload identity federation lets a workload authenticate to a cloud provider by presenting a short-lived token from an identity provider it already has, such a
- VendorSPIFFE / SPIRE
top_tier
- ExpertSPIFFE and SPIRE maintainer, co-author of Zero Trust Networks
Evan Gilman is a maintainer of SPIRE, the reference implementation of SPIFFE, and co-wrote O'Reilly's Zero Trust Networks. He was an engineer at Scytale, where
- Comparisonspiffe-spire-vs-hashicorp-vault
SPIFFE and SPIRE answer who a workload is. HashiCorp Vault answers what it may hold. They overlap enough to compare and differ enough that many teams run both.