Authenticate a service with a verifiable workload identity.
The Secure Production Identity Framework for Everyone (SPIFFE) defines workload identities. A SPIFFE Verifiable Identity Document (SVID) carries that identity in a form another workload can verify.
Why this lesson?
An Orders service needs to identify itself to an Inventory service. It uses a workload certificate instead of a shared password.
Learning goal and prerequisites
Obtain a workload certificate
The workload asks its local SPIFFE Workload application programming interface (API) for identity information. That local service identifies the caller and returns a short-lived workload identity document rather than a shared password.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Backend services need identities just as users do. Shared passwords and manually copied secrets are difficult to rotate and do not describe a workload very well. The Secure Production Identity Framework for Everyone (SPIFFE) provides a standard way to give running workloads stable identities without depending on permanent shared secrets.
A workload is assigned a SPIFFE identifier by trusted infrastructure. It receives a short-lived SPIFFE Verifiable Identity Document (SVID), often an X.509 certificate, that proves control of that identity. The private key stays with the workload while peers use trusted verification material to check the credential.
Workloads can use these credentials for mutual Transport Layer Security so both sides of a service connection know which workload they are communicating with. Policy can then refer to the stable workload identity instead of fragile details such as an Internet Protocol address or machine name.
The main benefit is automated lifecycle. Trusted infrastructure can issue and rotate short-lived credentials as workloads start, move, or stop. An SVID proves workload identity; it does not automatically grant every action. The receiving service still applies authorization policy to decide what that workload may do.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.