SPIFFE workload identity: what it is and why it matters

SPIFFE stands for Secure Production Identity Framework for Everyone. The name is a mouthful, but the core idea is simple: instead of authenticating a service by its IP address or hostname, you authenticate it by a cryptographically verifiable identity document that is tied to the workload itself. This article explains what that means in practice.

Why IP-based identity breaks down ¶

In a traditional setup, you might trust traffic from a particular IP range because that range is reserved for your internal services. This works until workloads start moving. Across hosts, across availability zones, across cloud regions. When a workload's IP changes, you either update your firewall rules or you accept that your trust model has gaps.

SPIFFE replaces the IP address as the unit of identity with a URI: spiffe://trust-domain/path. This URI is embedded in an X.509 certificate (called an SVID) that is issued by a trusted CA and rotated regularly. The certificate is what the peer validates, not the source IP.

Trust domains and federation ¶

A trust domain is the scope within which a particular CA's SVIDs are valid. In a single-organisation setup, you typically have one trust domain. If you need services in two separate environments to authenticate each other. A production mesh and a staging mesh, for example. You can federate the two trust domains by exchanging root certificates. Each side then trusts SVIDs issued by the other's CA.

Tuft Mesh Vault supports trust domain federation via a static bundle exchange. You export the root certificate bundle from one instance and import it into the other. Dynamic federation (where bundles are exchanged automatically via an API) is on the roadmap.

What changes operationally ¶

The main operational change is that workload registration becomes the source of truth for identity. When a new service is deployed, it registers with the control plane and receives an SVID. When it is decommissioned, it deregisters and the SVID is not renewed. There are no firewall rules to update, no IP allowlists to maintain.

The audit log records every SVID issuance and rotation. If you need to answer 'which workloads were active and authenticated at time T', the audit log has that answer.

The SPIFFE specification is published by the CNCF and is worth reading if you want the full technical detail. The Tuft Mesh Vault docs cover the specific implementation choices we made and where we diverge from the reference implementation.