# How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs

DevFeed: [How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs](<https://devfeed.tech/articles/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-29643.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/extend-spiffe-beyond-kubernetes/>)

Author: info@goteleport.com (Jeffrey Ellin)

Published: 2026-05-21T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [istio](<https://devfeed.tech/topics/istio.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [istio](<https://devfeed.tech/tags/istio.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [mesh](<https://devfeed.tech/tags/mesh.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>)

## AI overview

This tutorial explains how to extend SPIFFE-based zero-trust workload identity beyond Kubernetes to VMs, edge gateways, and legacy services. It describes separating identity issuance from consumption, using short-lived identities through a local API, with Envoy consuming identity via SDS and Teleport managing the trust chain.

## Source excerpt

Discover how Envoy + SDS and Teleport Workload Identity let off-cluster workloads securely call Istio services without distributing certificates.