Trust workload identities across separate trust domains.
Secure Production Identity Framework for Everyone (SPIFFE) federation lets one trust domain validate selected workload identities from another domain by trusting the other domain’s published verification material.
Why this lesson?
Two organizations manage separate SPIFFE domains. Their workloads need configured trust so they can verify each other’s certificates.
Learning goal and prerequisites
Obtain the other domain’s bundle
Domain A obtains domain B’s public trust bundle from an authenticated endpoint. A distributes that bundle to the workloads that need it. B separately configures trust in A. This step summarizes the infrastructure that manages those updates.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Workload identity is straightforward inside one trust domain because services already know which local authority they trust. The harder case appears when a workload in one organization must communicate with a workload in another organization that has its own signing authority. Federation creates an explicit way to extend verification across that boundary.
Secure Production Identity Framework for Everyone (SPIFFE) federation lets one trust domain obtain the public verification material for another trust domain. A service can then validate a remote workload’s SPIFFE Verifiable Identity Document without issuing that workload a new shared secret or replacing its existing identity.
This is useful when organizations or large platforms need service-to-service trust while keeping their identity systems separate. Each side remains responsible for its own workload identities and can decide exactly which external trust domains it will recognize.
Federation proves that a remote identity was issued by a trusted external domain. It does not mean every workload in that domain is authorized. The receiving service still checks the exact workload identifier and its local policy. Operators also need to update trust bundles and remove federation when the relationship ends.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.