agenticweb.wiki

SPIFFE (Secure Production Identity Framework for Everyone)

Last checked · 39 primary sources

This page is about SPIFFE, the CNCF set of open-source standards for giving software workloads a verifiable identity, and SPIRE, its reference implementation [1][5]. It is not WIMSE, the IETF working group whose charter lists the CNCF's SPIFFE/SPIRE project under "Dependencies and Liaisons" and whose architecture draft gives the SPIFFE ID as a conforming identifier [25][26]; see WIMSE. For signing individual HTTP requests, see HTTP Message Signatures.

Overview

The project describes SPIFFE this way: "SPIFFE, the Secure Production Identity Framework for Everyone, is a set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments." "Systems that adopt SPIFFE can easily and reliably mutually authenticate wherever they are running." [1]. Each workload is named by a SPIFFE ID, a URI beginning spiffe:// followed by its trust domain and a path [11], and receives an identity document (an SVID) carrying that ID, either as an X.509 certificate or as a JWT [12][13]. Other services check the SVID against the keys their trust domain publishes in a trust bundle, so two services can authenticate each other without a shared password [16]. SPIRE, the reference implementation, issues these identities: "SPIRE (the SPIFFE Runtime Environment) is the code that implements the SPIFFE specification on a wide variety of platforms and enforces multi-factor attestation for the issuance of identities." [5][23]. Palo Alto Networks Unit 42 summarises the purpose as follows: SPIFFE/SPIRE "is widely deployed in Kubernetes and cloud-native environments to replace long-lived secrets with short-lived, cryptographically verifiable workload identities." [37].

Why it matters for AI agents: an agent running in the cloud is a workload, so the same question arises of how it proves which agent it is to the tools, APIs and other agents it calls. Google Cloud's Agent Identity gives each agent a SPIFFE ID: "Each agent is assigned a unique identity string, or SPIFFE ID"; "Agent Identity provides a strongly attested, cryptographic identity for each agent that is based on the SPIFFE standard." "With Agent Identity, your agent can securely authenticate to MCP servers, cloud resources, endpoints, and other agents, acting either on its own behalf or on behalf of an end user." [29]. The IETF WIMSE working group's AI Identity Management System draft (a working group Internet-Draft, not a standard) builds on the same model: "This document describes how AI Agents should leverage existing standards defined by SPIFFE [SPIFFE], WIMSE, OAuth and OpenID SSF [SSF]." "An agent participating in this framework MUST be assigned exactly one WIMSE identifier, which MAY be a SPIFFE ID." [27]. SPIFFE identifies an agent but does not decide what it may do; Karthik Karunanithi, a solution architect at IBM, told InformationWeek "SPIFFE confirms the presence of agents and prevents spoofing. That's it," and that "an authorization layer must be layered on top of SPIFFE." [35]. Security researchers at Palo Alto Networks Unit 42 also showed that an attacker with root on a node can obtain the SVIDs of other workloads on that node, a technique Unit 42 says it has not seen used in the wild [37].

Who uses it

Listed only where the organisation states publicly, with a date, that it runs SPIFFE or SPIRE in its own infrastructure.

Not listed: organisations named only in lists or conference talks (for example the case-study talks linked from spiffe.io), because no dated first-party statement from each was opened for this check. No public statement was found showing an organisation running SPIRE to issue SVIDs to its own AI agents in production; Google's Agent Identity is listed under Who reads it as a vendor product [29].

Who reads it

Recent coverage

See also

References

  1. SPIFFE project, SPIFFE Overview (spiffe.io), checked 2026-10-28: "SPIFFE, the Secure Production Identity Framework for Everyone, is a set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments." "Systems that adopt SPIFFE can easily and reliably mutually authenticate wherever they are running." — https://spiffe.io/docs/latest/spiffe-about/overview/
  2. CNCF, SPIFFE project page, checked 2026-10-28: "SPIFFE was accepted to CNCF on March 29, 2018, moved to the Incubating maturity level on June 22, 2020, and then moved to the Graduated maturity level on August 23, 2022." — https://www.cncf.io/projects/spiffe/
  3. CNCF, SPIRE project page, checked 2026-10-28: "SPIRE was accepted to CNCF on March 29, 2018, moved to the Incubating maturity level on June 22, 2020, and then moved to the Graduated maturity level on August 22, 2022." — https://www.cncf.io/projects/spire/
  4. Kristen Evans, CNCF to host the SPIFFE Project (CNCF blog), 2018-03-29: "Posted on March 29, 2018" "Today, the Cloud Native Computing Foundation accepted SPIFFE into the CNCF Sandbox" "Sunil James, CEO of Scytale, a venture-backed company that serves as SPIFFE's primary maintainer" "Modeled after similar production systems at Google, Netflix, Twitter, and more" "The internal Google system that inspired SPIFFE" — https://www.cncf.io/blog/2018/03/29/cncf-to-host-the-spiffe-project/
  5. CNCF, TOC Approves SPIFFE and SPIRE to Incubation (CNCF blog), 2020-06-22: "Posted on June 22, 2020" "Today, the CNCF Technical Oversight Committee (TOC) voted to accept SPIFFE and SPIRE as incubation-level hosted projects." "SPIRE (the SPIFFE Runtime Environment) is the code that implements the SPIFFE specification on a wide variety of platforms and enforces multi-factor attestation for the issuance of identities." — https://www.cncf.io/blog/2020/06/22/toc-approves-spiffe-and-spire-to-incubation/
  6. CNCF, SPIFFE and SPIRE Projects Graduate from Cloud Native Computing Foundation Incubator (announcement), 2022-09-20 (date from the announcement URL and dateline): "SPIFFE and SPIRE Projects Graduate from Cloud Native Computing Foundation Incubator" "announced today the graduation of the SPIFFE and SPIRE projects." "By leveraging the SPIFFE/SPIRE framework, we built a zero trust infrastructure to secure hundreds of thousands of workloads within ByteDance" "Zhengqin Luo, Security Engineering Leader at Bytedance" "SPIFFE/SPIRE, the foundational building block of our zero trust infrastructure, enhances Indeed's agility" "Ken Adler, Director & Security Fellow, Indeed.com." "At HPE, SPIRE has become an integral part of the Cray System Management tooling" "Tim Pletcher, Principal Software Security Architect at Cray/HPE" "SPIFFE and SPIRE provide cryptographic, platform-agnostic identity foundation" "Sunil Ravipati, Zero-Trust Director at Carelon Digital Platforms." — https://www.cncf.io/announcements/2022/09/20/spiffe-and-spire-projects-graduate-from-cloud-native-computing-foundation-incubator/
  7. D. Feldman, E. Fox, E. Gilman, I. Haken, F. Kautz, U. Khan, M. Lambrecht, B. Lum, A. Martínez Fayó, E. Nesterov, A. Vega, M. Wardrop, Solving the Bottom Turtle (book, PDF, CC BY 4.0), first edition 2020: "k8s founding engineer Joe Beda, embarked on a call to arms in 2016 to create a solution for production identity" "Beda's paper was presented at GlueCon in 2016" — https://spiffe.io/pdf/Solving-the-bottom-turtle-SPIFFE-SPIRE-Book.pdf
  8. spiffe/spiffe, GOVERNANCE.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "The SPIFFE Project is governed by the SSC that is exclusively responsible for SPIFFE's standards and the Project's strategic goals and direction." "The SSC is comprised of at least five (5) members." "All software is licensed under the Apache License version 2.0, and all documentation is licensed under the Creative Commons License version 4.0." — https://github.com/spiffe/spiffe/blob/main/GOVERNANCE.md
  9. spiffe/spiffe, SPIFFE Steering Committee ssc/README.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "The SPIFFE Steering Committee (or SSC) is a group of volunteers that oversee the strategic direction and growth of all projects falling under the SPIFFE umbrella." — https://github.com/spiffe/spiffe/blob/main/ssc/README.md
  10. spiffe/spiffe, The SPIFFE standard standards/SPIFFE.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "The SPIFFE standard comprises three major components - one which standardizes an identity namespace, one which dictates the manner in which an issued identity may be presented and verified, and another which specifies an API through which identity may be retrieved and/or issued. These components are known as the SPIFFE ID, the SPIFFE Verifiable Identity Document (SVID) and the Workload API" — https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE.md
  11. spiffe/spiffe, SPIFFE-ID.md standards/SPIFFE-ID.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "Valid SPIFFE IDs MUST have the scheme set to spiffe, include a non-zero trust domain name, and MUST NOT include a query or fragment component." "The trust domain corresponds to the trust root of a system." — https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md
  12. spiffe/spiffe, X509-SVID.md standards/X509-SVID.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "In an X.509 SVID, the corresponding SPIFFE ID is set as a URI type in the Subject Alternative Name extension" "An X.509 SVID MUST contain exactly one URI SAN, and by extension, exactly one SPIFFE ID." — https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
  13. spiffe/spiffe, JWT-SVID.md standards/JWT-SVID.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "JWT-SVID is the first token-based SVID in the SPIFFE specification set." "Being a bearer token, JWT-SVIDs are susceptible to replay attacks." — https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md
  14. spiffe/spiffe, SPIFFE_Workload_API.md standards/SPIFFE_Workload_API.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "The SPIFFE Workload API includes RPCs utilizing gRPC server-side streams in order to facilitate rapid propagation of updates like revocations and CA certificate introductions." "Stability: Incubating (this section only - the remainder of this document is Stable.)" — https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
  15. spiffe/spiffe, SPIFFE_Workload_Endpoint.md standards/SPIFFE_Workload_Endpoint.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "The SPIFFE Workload Endpoint MUST be served over gRPC, and compliant clients MUST support gRPC. It may be exposed as either a Unix Domain Socket (UDS) or a TCP listen socket." — https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_Endpoint.md
  16. spiffe/spiffe, SPIFFE_Trust_Domain_and_Bundle.md standards/SPIFFE_Trust_Domain_and_Bundle.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "A SPIFFE bundle is an object containing a trust domain's cryptographic keys." "SPIFFE bundles are represented as an RFC 7517 compliant JWK Set." — https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md
  17. spiffe/spiffe, SPIFFE_Federation.md standards/SPIFFE_Federation.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Stable" "SPIFFE Federation enables the authentication of identity credentials (SVIDs) across trust domains." "SPIFFE Federation defines a "bundle endpoint", which is a URL that serves up a SPIFFE bundle for a particular trust domain." — https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md
  18. spiffe/spiffe, STABILITY.md standards/STABILITY.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "This document defines stability levels for SPIFFE specifications and the process for moving a specification between them." — https://github.com/spiffe/spiffe/blob/main/standards/STABILITY.md
  19. spiffe/spiffe, WIT-SVID.md standards/WIT-SVID.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "Stability: Incubating" "The Workload Identity Token (WIT) is a token format specified by the IETF WIMSE working group in the WIMSE Workload Credentials document." "The WIT-SVID is a sub-profiling of this token format for use in SPIFFE contexts." "As the WIT-SVID is a sub-profiling of the WIMSE WIT, all WIT-SVIDs are WIMSE WITs and implementations designed to consume WIMSE WITs will be compatible with WIT-SVIDs." — https://github.com/spiffe/spiffe/blob/main/standards/WIT-SVID.md
  20. GitHub API, commit history of standards/STABILITY.md in spiffe/spiffe (timestamps in UTC), checked 2026-10-28: ""date": "2026-07-01T15:58:51Z"" ""message": "Introduce Stability/Graduation process for SPIFFE specifications (#399)" — https://api.github.com/repos/spiffe/spiffe/commits?path=standards/STABILITY.md&per_page=100
  21. GitHub API, commit history of standards/WIT-SVID.md in spiffe/spiffe (timestamps in UTC), checked 2026-10-28: ""date": "2026-07-01T16:46:48Z"" ""message": "Integrating WIT to the SPIFFE standards (#362)" — https://api.github.com/repos/spiffe/spiffe/commits?path=standards/WIT-SVID.md&per_page=100
  22. GitHub API record for spiffe/spiffe (timestamps in UTC), checked 2026-10-28: ""created_at": "2017-08-07T20:45:21Z"" — https://api.github.com/repos/spiffe/spiffe
  23. spiffe/spire, README.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "SPIRE (the SPIFFE Runtime Environment) is a toolchain of APIs for establishing trust between software systems" "SPIRE is a graduated project of the Cloud Native Computing Foundation" — https://github.com/spiffe/spire/blob/main/README.md
  24. GitHub API, latest release of spiffe/spire (timestamps in UTC), checked 2026-10-28: ""tag_name": "v1.15.5"" ""published_at": "2026-10-20T18:35:18Z"" — https://api.github.com/repos/spiffe/spire/releases/latest
  25. IETF Datatracker, Workload Identity in Multi System Environments (wimse), working group page and charter, checked 2026-10-28: "These technologies (specifically: OAuth, JWT, and SPIFFE) have been combined in a variety of ways in practice, but the solutions have existed in relative isolation." "Dependencies and Liaisons The WIMSE working group will closely collaborate with:" "The Cloud Native Computing Foundation (CNCF), particularly with regard to the SPIFFE/SPIRE project." — https://datatracker.ietf.org/wg/wimse/about/
  26. J. Salowey, Y. Rosomakho, H. Tschofenig, Workload Identity in a Multi System Environment (WIMSE) Architecture, draft-ietf-wimse-arch-08 (IETF Datatracker), checked 2026-10-28: "Workload Identity in a Multi System Environment (WIMSE) Architecture draft-ietf-wimse-arch-08" "An example of an identifier format that conforms to this definition is [SPIFFE-ID]." — https://datatracker.ietf.org/doc/draft-ietf-wimse-arch/
  27. P. Kasselman, J. Lombardo, Y. Rosomakho, B. Campbell, N. Steele, A. Parecki, AI Identity Management System, draft-ietf-wimse-aims-00 (IETF Datatracker), 15 September 2026: "AI Identity Management System draft-ietf-wimse-aims-00" "A. Parecki Okta 15 September 2026" "This document describes how AI Agents should leverage existing standards defined by SPIFFE [SPIFFE], WIMSE, OAuth and OpenID SSF [SSF]." "The Secure Production Identity Framework for Everyone ([SPIFFE]) identifier is a widely deployed and operationally mature instance of the WIMSE identifier model [WIMSE-ID]." "An agent participating in this framework MUST be assigned exactly one WIMSE identifier, which MAY be a SPIFFE ID." "X.509-SVID is compatible with WIC, while WIT-SVID profiles WIT." — https://datatracker.ietf.org/doc/draft-ietf-wimse-aims/
  28. Andrew Moore, Zachary Train, Kirutthika Raja, Our Journey Adopting SPIFFE/SPIRE at Scale (Uber blog), 2023-11-09: "November 9, 2023 Our Journey Adopting SPIFFE/SPIRE at Scale" "We use SPIRE at Uber to provide identity to workloads running in multiple clouds (GCP, OCI, AWS, on-premise) for a variety of jobs, including stateless services, stateful storage, batch and streaming jobs, CI jobs, workflow executions, infrastructure services, and more." "We have worked with the open source community since the early stages of the project in mid-2018" — https://www.uber.com/us/en/blog/our-journey-adopting-spiffe-spire/
  29. Google Cloud documentation, Agent Identity overview (page last updated 2026-10-27 UTC), checked 2026-10-28: "Each agent is assigned a unique identity string, or SPIFFE ID" "Agent Identity provides a strongly attested, cryptographic identity for each agent that is based on the SPIFFE standard." "This identity is strongly attested, tied to the agent's lifecycle, and mapped directly to the resource URI where the agent is hosted." "With Agent Identity, your agent can securely authenticate to MCP servers, cloud resources, endpoints, and other agents, acting either on its own behalf or on behalf of an end user." "The following services support Agent Identity: Gemini Enterprise Agent Platform Runtime (Agent Runtime) Gemini Enterprise Cloud Run" "Last updated 2026-10-27 UTC." — https://docs.cloud.google.com/iam/docs/agent-identity-overview
  30. Abhishek A Hemrajani, Google, What's new in IAM, Access Risk, and Cloud Governance (Google Cloud Blog), 2025-05-02: "May 2, 2025" "Managed Workload Identities (in preview) based on the Secure Production Identity Framework For Everyone (SPIFFE) standard, enabling secure identification, authentication, and mutual TLS (mTLS) encryption for workload to workload communication" — https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-access-risk-and-cloud-governance
  31. Microsoft Learn, Federate a SPIFFE/SPIRE workload identity (Microsoft Entra Workload ID; page last updated 2026-08-13), checked 2026-10-28: "the workload exchanges its SPIFFE JWT-SVID for a Microsoft Entra access token and calls an Azure resource, such as Azure Blob Storage, without storing any secrets or certificates." "Last updated on 2026-08-13" — https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-spiffe-spire
  32. Anjali Telang and Trilok Geer, Red Hat, Zero trust workload identity manager generally available on Red Hat OpenShift (Red Hat blog), 2026-01-23: "January 23, 2026" "We're excited to announce the general availability of zero trust workload identity manager" "Zero trust workload identity manager is based on the upstream SPIRE project, the reference implementation of the SPIFFE standard for workload identity." — https://www.redhat.com/en/blog/zero-trust-workload-identity-manager-generally-available-red-hat-openshift
  33. Venu Shastri and Joe Garcia, Palo Alto Networks, Why Cryptographically Verifiable SPIFFE Identity is Key to Scaling AI Agents (Idira, Palo Alto Networks Blog), 2026-07-20: "Why Cryptographically Verifiable SPIFFE Identity is Key to Scaling AI Agents" "Jul 20, 2026" "The Idira Secure AI Agent solution leverages SPIFFE to issue every AI agent a unique, verifiable cryptographic identity—a SPIFFE Verifiable Identity Document (SVID)." — https://www.paloaltonetworks.com/blog/identity-security/ai-agent-security-spiffe-machine-identity/
  34. Ben Arent, Teleport, Teleport Workload Identity (Teleport blog), 2024-04-11: "Published April 11, 2024" "Teleport Workload Identity extends Teleport Machine ID with a SPIFFE workload API endpoint, the ability to issue SVIDs, new TPM server attestation* and support for AWS Roles Anywhere." — https://goteleport.com/blog/workload-identity/
  35. Pam Baker, SPIFFE can identify your AI agents. But can it control them? (InformationWeek), 2026-10-15: "Pam Baker, Contributing Writer October 15, 2026" "SPIFFE confirms the presence of agents and prevents spoofing. That's it," "said Karthik Karunanithi, solution architect at IBM." "an authorization layer must be layered on top of SPIFFE." — https://www.informationweek.com/responsible-ai/spiffe-can-identify-your-ai-agents-but-can-it-control-them-
  36. Diogo Carleto, HashiCorp Vault 1.21 Brings SPIFFE Authentication, Granular Secret Recovery, and More (InfoQ), 2026-03-28: "HashiCorp Vault 1.21 Brings SPIFFE Authentication, Granular Secret Recovery, and More Mar 28, 2026" "This version introduces native SPIFFE authentication for non-human workloads" "This makes Vault both a consumer and issuer of SPIFFE identities" — https://www.infoq.com/news/2026/03/hashicorp-vault-1-21/
  37. Eviatar Garzi, Palo Alto Networks Unit 42, The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE (Unit 42), 2026-09-10: "Published: September 10, 2026" "This research demonstrates post-exploitation techniques that could allow an attacker with root access on a compromised Kubernetes node to misuse an open standard and reference implementation for machine identity known as SPIFFE/SPIRE to impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs)." "Unit 42 has not observed this technique exploited in the wild." "is widely deployed in Kubernetes and cloud-native environments to replace long-lived secrets with short-lived, cryptographically verifiable workload identities." — https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/
  38. spiffe/spire, CHANGELOG.md (text checked at the raw.githubusercontent.com copy), checked 2026-10-28: "[1.15.3] - 2026-08-21" "Incremental WIT-SVID work, including support for building WIT-SVIDs in the svid.v1 API client and marshalling support for WIT-SVID keys (#7132, #7134)" — https://github.com/spiffe/spire/blob/main/CHANGELOG.md
  39. GitHub API, spiffe/spire issue #6326 (timestamps in UTC), checked 2026-10-28: ""title": "WIT-SVID support in SPIRE"" ""state": "open"" ""created_at": "2025-09-18T14:22:38Z"" — https://api.github.com/repos/spiffe/spire/issues/6326

JSON · Markdown · OKF v0.2