# SPIRE SPIRE (the SPIFFE Runtime Environment) is a toolchain of APIs for establishing trust between software systems across a wide variety of hosting platforms. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Security Baked Into the JVM: two Subjects, one call DevFeed: [Security Baked Into the JVM: two Subjects, one call]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-09T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [SPIFFE](), [SPIRE]() Tags: [certificates](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [jwt](), [microservices](), [oidc](), [permission](), [process](), [security](), [spiffe](), [spire](), [technical]() ### AI overview This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries. ### Source excerpt The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently. ## Zero trust architecture for platform engineers: Securing modern developer platforms DevFeed: [Zero trust architecture for platform engineers: Securing modern developer platforms]() Original publisher: [Read original article]() Author: Ajay Chankramath Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Zero Trust](), [Security](), [Architecture & Design](), [Platform Engineering](), [Authentication](), [Authorization](), [Cloud](), [Kubernetes](), [Network Segmentation](), [SPIFFE](), [SPIRE]() Tags: [architecture](), [authentication](), [authorization](), [cloud](), [cloud-native](), [developer](), [identity](), [kubernetes](), [network-segmentation](), [platform](), [platform-engineering](), [policy](), [security](), [spiffe](), [spire](), [zero-trust]() ### AI overview This article explains how zero-trust architecture secures cloud-native developer platforms. It describes continuous authentication and authorization, cryptographic service identity through SPIFFE/SPIRE, network segmentation, policy-as-code enforcement, and runtime verification for Kubernetes-based, multi-tenant environments. ### Source excerpt Secure your cloud-native platform with Zero Trust Architecture. Explore ZTA principles, service identity (SPIFFE/SPIRE), and policy-as-code for automated, developer-friendly security ## CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration DevFeed: [CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration]() Original publisher: [Read original article]() Author: Sanchit Khanna,Biplav Saraf Published: 2026-03-13T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [Databases](), [SPIFFE](), [SPIRE](), [certificates](), [Zero Trust](), [Security](), [Microservice]() Tags: [architectures](), [auditability](), [aws-iam](), [certificates](), [cockroachdb](), [compliance](), [cryptographic](), [database](), [distributed](), [processor](), [regex](), [security](), [soc](), [soc-2](), [spiffe](), [spire](), [standards](), [teams](), [verification](), [zero-trust]() ### AI overview The article previews planned CockroachDB authentication support for Subject Alternative Name fields in X.509 certificates. It explains how SAN support is intended to enable integration with SPIFFE and SPIRE and support regex-based identity mapping for cloud-native workloads. ### Source excerpt In the evolution of cloud-native security, identity has become the new perimeter. ## Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users DevFeed: [Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users]() Original publisher: [Read original article]() Author: Nikhil Arora Published: 2024-07-03T15:52:26Z Content type: tutorial Language: en Sources: [Indeed]() Topics: [SPIRE](), [istio](), [Kubernetes](), [OpenID connect (OIDC)](), [Zero Trust](), [AWS Identity and Access Management (IAM)](), [Architecture & Design]() Tags: [authentication](), [authorization](), [aws-iam](), [credentials](), [guide](), [identity](), [istio](), [kubernetes](), [oidc](), [secrets](), [spire](), [unsorted](), [zero-trust]() ### AI overview This guide describes Indeed's approach to building a workload identity platform for Kubernetes and Istio using SPIRE and OIDC, with identities and access controls rooted in Zero Trust principles. It discusses credential risks, design choices, and implementation challenges for heterogeneous first-party and third-party workloads. ### Source excerpt Goal This blog is for engineering teams, architects, and leaders responsible for defining and implementing a workload identity platform and access controls rooted in Zero Trust principles to mitigate the risks from compromised services. It is relevant for companies using Kubernetes to manage workloads, using Istio for service mesh, and aiming to define identities in [...] ## Teleport Workload Identity DevFeed: [Teleport Workload Identity]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2024-04-11T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [SPIFFE](), [SPIRE](), [Security](), [Architecture & Design](), [Microservice](), [TLS (Transport Layer Security)](), [Zero Trust]() Tags: [api](), [bootstrapping](), [identity](), [preview](), [security](), [services](), [spiffe](), [spire](), [tls](), [x509](), [zero-trust]() ### AI overview An introduction to Teleport Workload Identity, a preview feature that bootstraps and issues identities to services across heterogeneous environments and organizational boundaries. It builds on SPIFFE and adds a SPIFFE workload API endpoint, SVID issuance, TPM server attestation, and AWS Roles Anywhere support. ### Source excerpt An introduction to Teleport Workload Identity, a preview feature for bootstrapping and issuing identities to services across heterogeneous environments. ## Connecting Block Business Units with AWS API Gateway DevFeed: [Connecting Block Business Units with AWS API Gateway]() Original publisher: [Read original article]() Author: Michael Weissbacher Published: 2023-05-18T13:00:00Z Content type: article Language: en Sources: [Square Corner Blog](), [Square Corner Blog RSS Feed]() Topics: [Amazon API Gateway](), [Amazon Web Services](), [Security](), [SPIFFE](), [SPIRE]() Tags: [api-gateway](), [aws](), [aws-api-gateway](), [engineering](), [network](), [security](), [spiffe](), [spire]() ### AI overview This article explains how Block integrates acquired companies with its internal service mesh using AWS API Gateway as an identity translation layer. The Farcars infrastructure maps acquisition-native identities and IAM-based SigV4 calls to Block-native mutual TLS, enabling isolated and reusable cross-mesh communication. ### Source excerpt Secure cross-mesh communication using in-mesh bastions ## Join Chainguard at KubeCon EU in Amsterdam April 19-21! DevFeed: [Join Chainguard at KubeCon EU in Amsterdam April 19-21!]() Original publisher: [Read original article]() Published: 2023-04-13T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Kubernetes](), [supply-chain-security](), [chainguard images](), [chainguard enforce](), [sigstore](), [SPIRE](), [eBPF](), [observability](), [Open Source]() Tags: [chainguard](), [chainguard-enforce](), [chainguard-images](), [cloud-native](), [cncf](), [cves](), [ebpf](), [kubecon](), [kubecon-eu](), [kubernetes](), [linux-foundation](), [observability](), [open-source](), [security](), [sigstore](), [spire](), [supply-chain]() ### AI overview Chainguard announces its participation in KubeCon EU 2023 in Amsterdam, including booth demonstrations of the Chainguard platform and Chainguard Images. The article highlights comparisons of minimal container image size and CVE counts, Chainguard Enforce visibility into deployed software and dependencies, and conference sessions on CI/CD security on Kubernetes, SLSA, Tekton, Sigstore, SPIRE, and Falco. ### Source excerpt Join Chainguard at KubeCon EU in Amsterdam, April 19-21, for groundbreaking insights into cloud-native technologies. ## How we Integrated SPIFFE, Oauth2.0 and Spring Boot DevFeed: [How we Integrated SPIFFE, Oauth2.0 and Spring Boot]() Original publisher: [Read original article]() Author: Matthew Benedict Stocks Published: 2022-12-14T09:36:48Z Content type: tutorial Language: en Sources: [Wise Engineering - Medium]() Topics: [SPIFFE](), [Authorization](), [OpenID connect (OIDC)](), [SPIRE](), [Library](), [Security](), [Spring Boot]() Tags: [authorization](), [cybersecurity](), [library](), [oauth2](), [platform](), [security](), [service-mesh](), [spiffe](), [spring-boot]() ### AI overview Wise's Security Engineering team describes how it consolidated SPIFFE/SPIRE and OIDC authorization strategies into the wise-security shared library. The approach reduces Spring Security boilerplate, presents a consistent service-layer security context, and adds guardrails intended to reduce misconfiguration and authorization complexity. ### Source excerpt How we Integrated SPIFFE, OAuth2 and Spring Boot At Wise the Security Engineering team supports the Security Squad by developing tools and building technical controls relevant to the security maturity of existing technological setup. We work closely with teams across Platform and Product to help improve our overall security posture and reduce the friction encountered when engineering new software at speed. Photo by Jason Dent on UnsplashThe problem As a company we have a goal of reducing the amount of time it takes to go from inception to creation with our services. We want teams across Wise to be able to focus on the challenges encountered in their domain, rather than cross-cutting concerns, such as how to secure their endpoints. At Wise our approach was to create a common shared library, allowing teams to share our security solution while still retaining their autonomy. Standard security setups such as those seen with Spring Security often require a lot of boilerplate code (even if provided as part of a service template) which we wanted to reduce and where possible, abstract it entirely. Along with improving the quality of life for new and experienced engineers within Wise, this also helps to prevent any misconfiguration that could eventually lead to a vulnerability. Another challenge which arose was to offer a security context that appears the same at the service layer, but can be created from any of the protocols used by our systems, as well as being extensible if necessary. We needed to allow developers to control access to services with minimal effort, alongside creating a security guardrail for exposed endpoints to ensure services have been configured correctly. Introducing Wise Security At Wise, our service mesh layer is handled by Envoy and the identity framework for secure communication between mesh nodes is SPIFFE/SPIRE. User based IAM is handled via the OIDC authorization protocol. Each authorization approach must be enforced at the service layer, but du ## AWS OIDC Authentication with SPIFFE DevFeed: [AWS OIDC Authentication with SPIFFE]() Original publisher: [Read original article]() Author: Roy Xu Published: 2021-08-26T19:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog](), [Square Corner Blog RSS Feed]() Topics: [Amazon Web Services](), [OpenID connect (OIDC)](), [SPIFFE](), [SPIRE](), [Security](), [Secrets Management](), [Authentication](), [datacenter](), [Amazon S3](), [Amazon Simple Queue Service (SQS)](), [migration]() Tags: [app](), [authorization](), [automated](), [aws](), [cloud](), [datacenter](), [engineering](), [kubernetes](), [oidc](), [s3](), [secrets-management](), [security](), [spiffe](), [spire](), [sqs]() ### AI overview Square describes using SPIFFE and SPIRE's OIDC Discovery Provider to exchange SPIFFE JWTs for AWS credentials, allowing datacenter applications to assume AWS roles through an automated configuration-based process. ### Source excerpt Easy authentication with automated AWS credentials ## Providing mTLS Identities to Lambdas DevFeed: [Providing mTLS Identities to Lambdas]() Original publisher: [Read original article]() Author: Michael Weissbacher Published: 2020-08-25T19:00:00Z Content type: article Language: en Sources: [Square Corner Blog](), [Square Corner Blog RSS Feed]() Topics: [AWS Lambda](), [TLS (Transport Layer Security)](), [SPIFFE](), [SPIRE](), [Security](), [Authentication](), [datacenter](), [Microservice](), [Serverless](), [AWS IAM]() Tags: [audit-trail](), [authentication](), [aws-lambda](), [engineering](), [identity](), [microservices](), [secrets](), [security](), [serverless](), [spiffe](), [spire](), [tls]() ### AI overview Square describes a system that gives AWS Lambda applications short-lived, SPIFFE-compatible certificates for authenticated calls to microservices in its data centers. The design uses mutual TLS, AWS Private Certificate Authority, Secrets Manager, IAM policies, and advance certificate issuance to preserve security while keeping Lambda cold starts low. ### Source excerpt Securing severless communication with our data centers