SPIFFE IDs & SVIDs

Trust domains, X.509 vs JWT identity documents.

SPIFFE — Secure Production Identity Framework For Everyone — is the open standard that makes workload identity portable and verifiable across clusters, clouds, and even VMs. It defines what a workload identity is and how it is proven, which is the vocabulary every mesh and identity system in this course speaks.

SPIFFE IDs and SVIDs

A SPIFFE ID is a URI of the form spiffe://trust-domain/path — for example spiffe://acme.internal/ns/prod/sa/payments — that names a workload within a trust domain. The workload proves it holds that identity by presenting an SVID (SPIFFE Verifiable Identity Document), which comes in two forms: an X.509-SVID (a certificate, ideal for mTLS between services) or a JWT-SVID (a token, ideal for request-level authentication across L7 proxies). The trust domain is the root of trust — a CA under which all its identities are issued and verified — and a trust bundle is the set of public keys used to verify SVIDs from a domain.

# SPIFFE ID — a URI naming a workload in a trust domain:
spiffe://acme.internal/ns/prod/sa/payments
#         └── trust domain ──┘└─── path (who) ───┘
 
# SVID — the credential proving that ID:
#   X.509-SVID : a short-lived cert with the SPIFFE ID in a URI SAN  → mTLS
#   JWT-SVID   : a short-lived token with the SPIFFE ID as subject    → L7 / requests
 
# Trust bundle: the public roots used to VERIFY SVIDs from a trust domain.

Why a standard matters

Before SPIFFE, every platform invented its own workload-identity scheme, so identities did not travel — a Kubernetes service account meant nothing to a VM or another cloud. SPIFFE gives one portable identity plane: the same identity model works for pods, VMs, serverless, and across organizations, and any SPIFFE-aware system (Istio, Linkerd, SPIRE, cloud services) can consume it. That portability is what enables federation across trust domains and consistent authentication in heterogeneous environments. SPIFFE defines the identity; SPIRE (next lesson) is the runtime that actually issues and rotates it.