Главная
Study mode:
on
1
Intro
2
Agenda Motivation
3
Motivation Make a single standard of identity between workloads a utility for teams
4
A Layered Approach
5
SPIRE Setup: Take One
6
DaemonSet Issues Availability - Daemon Set Pods are terminated before replacements scheduled Race Conditions - Pod creation is unordered per Kube Node Dual Maintenance
7
SPIRE Setup: Take Two Reprovision SPIRE as a Systemd Unit - Availability
8
Exposing The Agent To Pods
9
Generating Custom Node Selectors
10
The x509Pop NodeAttestor SPIRE Server Config Snippet
11
Custom NodeResolver Plugin
12
Custom Selectors
Description:
Explore SPIFFE implementation at GitHub in this 26-minute conference talk. Learn about the deployment of SPIRE and its plugin system integration with internal systems and tooling. Discover the motivation behind standardizing identity between workloads, the layered approach taken, and the challenges faced during initial setup. Gain insights into the improved SPIRE setup, including reprovisioning as a Systemd Unit, exposing the agent to pods, generating custom node selectors, and implementing the x509Pop NodeAttestor. Understand the SPIRE server configuration and custom NodeResolver plugin used at GitHub to empower teams in managing interoperable Production Identity documents.

SPIFFE at GitHub

CNCF [Cloud Native Computing Foundation]
Add to list
0:00 / 0:00