SPIFFE (Secure Production Identity Framework for Everyone) is a graduated CNCF set of specifications for workload identity. It defines a URI naming scheme for workloads, verifiable identity documents (SVIDs) in X.509 and JWT form, and a Workload API for obtaining them without embedded credentials.
SPIFFE
SPIFFE answers a question most API security models skip: before you authorize a call, how does the calling workload prove what it is? Not the end user, and not an API key somebody pasted into an environment variable — the service itself. SPIFFE gives every workload a URI-shaped identity, a short-lived verifiable document asserting it, and a local API for fetching that document with no secret to distribute in the first place.
- SPIFFE ID - A URI (
spiffe://trust-domain/path) that names a workload inside a trust domain. - SVID - The verifiable identity document, issued as either an X.509 certificate or a JWT, and deliberately short-lived.
- Workload API - A local gRPC API a workload calls to get its own identity and the trust bundles it needs, so nothing has to be provisioned into the image.
- Graduated at CNCF - Alongside SPIRE, the reference implementation most deployments actually run.
For API operations SPIFFE is the piece underneath the authorization gap that the OAuth 2.0 and OpenID Connect reports keep running into. Those standards describe how a credential is obtained and what it may do; SPIFFE describes how the thing holding it got an identity at all. In an agentic estate — where the caller is increasingly a process nobody logged into — machine identity stops being an infrastructure detail and becomes part of the API contract. It pairs with mTLS as the mechanism and with SLSA and in-toto as the provenance story for the artifact that workload is running.
Open source tools that implement this standard
Harvested from this standard's own governing organisation, with the license read from each repository rather than assumed. The role is what the tool does to the specification, from the shared vocabulary — so an agent holding one of these documents can resolve straight from a goal to a tool.
| Tool | Role | License | What it does |
|---|---|---|---|
| SPIRE | issues |
Apache-2.0 | The SPIFFE Runtime Environment — attests workloads and issues them short-lived cryptographic identities, so services authentica... |
| go-spiffe | verifies |
Apache-2.0 | The Go library for consuming SPIFFE identities — fetches SVIDs from the Workload API and validates peer identities. |
| Tornjak | manages |
Apache-2.0 | A management UI and API over SPIRE, for viewing and administering workload identities. |
| SPIFFE Helper | issues |
Apache-2.0 | Fetches SVIDs from the Workload API and writes them to disk, restarting or signalling a process on rotation — how software that... |
| SPIRE Controller Manager | deploys |
Apache-2.0 | Reconciles workload registration in Kubernetes, so SPIFFE identities are declared as cluster resources rather than registered b... |
| java-spiffe | verifies |
Apache-2.0 | The Java library for consuming SPIFFE identities and validating peers. |
