Skills-SI市场
skills-si.com
提交技能
/
界面已本地化；技能介绍与说明文档按所选语言由 AI 自动翻译，代码、命令、路径和专业术语保留原文，以原作者文档为准。
探索技能
效率与协作 · SKILL.md

spiffe

spiffe

【效率与协作】"Provides SPIFFE in Secure Product Identity Framework for Applications"

独立 GitHub 快照 · 自动分类 · 以原作者文档为准

Ppaulpas / agent-skill-routerMIT

技能说明

GitHub

name: spiffe compatibility: opencode completeness: 95 content-types:

  • guidance
  • examples
  • do-dont
  • config description: '"Provides SPIFFE in Secure Product Identity Framework for Applications"' license: MIT maturity: stable metadata: domain: cncf output-format: manifests related-skills: null role: reference scope: infrastructure triggers: identity, product, secure, spiffe archetypes:
    • educational
    • strategic anti_triggers:
    • brainstorming
    • vague ideation
    • non-containerized architecture response_profile: verbosity: medium directive_strength: low abstraction_level: strategic version: "1.0.0"

SPIFFE in Cloud-Native Engineering

Category: Security & Identity
Status: Active
Stars: 1,400
Last Updated: 2026-04-22
Primary Language: Go
Documentation: Secure Product Identity Framework for Applications

Purpose and Use Cases

SPIFFE is a core component of the cloud-native ecosystem, serving as for Applications

What Problem Does It Solve?

SPIFFE addresses the challenge of secure workload identity in dynamic environments. It provides standardized identity framework, secure service-to-service authentication, and workload identity management.

When to Use This Project

Use SPIFFE when need secure identity for microservices, require service-to-service authentication, or manage dynamic workloads. Not ideal for simple deployments or when implementing zero-trust architecture, managing microservices identity, or requiring secure workload communication.

Key Use Cases

  • Microservices Service-to-Service Authentication
  • Zero Trust Network Architecture
  • Workload Identity Management
  • Secure API Communication
  • Dynamic Environment Identity

Architecture Design Patterns

Core Components

  • SPIRE Server: Central identity authority
  • SPIRE Agent: Runs on each node
  • Workload API: Identity issuance API
  • SVID: SPIFFE Verifiable Identity Document
  • Federated Trust Domain: Cross-domain trust

Component Interactions

  1. Workload → SPIRE Agent: Workload requests identity
  2. SPIRE Agent → SPIRE Server: Agent validates with server
  3. SPIRE Server → Workload: Server issues SVID
  4. Workload → Workload: Mutual TLS authentication

Data Flow Patterns

  1. Identity Request: Workload → Agent → Server → SVID
  2. Identity Renewal: Periodic SVID renewal
  3. Federated Trust: Cross-domain identity validation
  4. Revocation: SVID revoked when no longer needed

Design Principles

  • Identity-Based: Identity based on workload properties
  • Verifiable: SVIDs cryptographically verifiable
  • Dynamic: Handles dynamic workload creation
  • Standardized: Open standard via CNCF

Integration Approaches

Integration with Other CNCF Projects

  • SPIRE: SPIFFE implementation
  • Istio: Service mesh integration
  • Envoy: Proxy integration
  • Kubernetes: Workload integration

API Patterns

  • Workload API: Identity issuance API
  • Node API: Node attestation API
  • Registration API: Registration entry management
  • SVID API: SVID issuance and renewal

Configuration Patterns

  • SPIRE Server YAML: Server configuration
  • SPIRE Agent YAML: Agent configuration
  • Registration Entries: Identity registration
  • SPIRE Config: Main configuration

Extension Mechanisms

  • Custom Attestors: Add attestation methods
  • Custom Plugins: Extend functionality
  • Custom SVID Formats: Support additional formats

Common Pitfalls and How to Avoid Them

Misconfigurations

  • Agent Connectivity: Agent cannot reach server
    • How to Avoid: Check network connectivity, firewall rules, server health
  • Trust Domain Conflict: Trust domain collisions
    • How to Avoid: Use unique trust domain names

Performance Issues

  • SVID Expiration: SVID expiration causing failures
    • How to Avoid: Configure renewal, monitor expiry
  • Performance Impact: Identity service impacts application
    • How to Avoid: Use caching, optimize agent placement

Operational Challenges

  • Security Exposure: SVID compromise
    • How to Avoid: Use short TTLs, implement revocation, rotate keys
  • ** Scaling**: SPIRE server scalability
    • How to Avoid: Scale server, use cluster mode

Security Pitfalls

Coding Practices

Idiomatic Configuration

  • Identity Management: Integrate SPIFFE identity in applications
  • SVID Handling: Proper SVID loading and renewal
  • Mutual TLS: Implement mTLS with SPIFFE IDs

API Usage Patterns

  • SPIRE CLI: spikey for identity management
  • Workload API: Programmatic identity access
  • Registration CLI: Manage registration entries
  • SPIRE Server API: Server management

Observability Best Practices

  • Identity Metrics: Track identity issuance
  • Agent Health: Monitor agent status
  • Revocation Metrics: Track revocations

Testing Strategies

  • Integration Tests: Test identity flow
  • Security Tests: Validate security claims
  • Federation Tests: Test cross-domain trust

Development Workflow

  • Local Development: Use SPIRE in development
  • Debug Commands: Check agent and server logs
  • Test Environment: Set up test SPIRE deployment
  • CI/CD Integration: Automate identity testing
  • Monitoring Setup: Configure SPIRE observability
  • Documentation: Maintain SPIRE guides

Fundamentals

Essential Concepts

  • SPIFFE ID: Unique workload identifier
  • SVID: SPIFFE Verifiable Identity Document
  • SPIFFE Server: Central identity authority
  • SPIRE Agent: Node-level identity agent
  • Trust Domain: Identity namespace
  • Attestation: Workload identity validation
  • Registration Entry: Identity configuration
  • Federated Trust: Cross-domain trust

Terminology Glossary

  • SPIFFE: Secure Product Identity Framework for Applications
  • SVID: SPIFFE Verifiable Identity Document
  • SPIRE: SPIFFE Runtime Environment
  • Trust Domain: Identity namespace
  • Attestation: Identity validation process

Data Models and Types

  • SPIFFE ID: Workload identity URI
  • SVID: Identity document
  • Registration Entry: Identity configuration
  • Trust Bundle: Trust domain public keys

Lifecycle Management

  • Identity Issuance: Workload starts → Agent attests → Server issues SVID
  • SVID Renewal: Periodic renewal before expiry
  • Identity Revocation: Workload removed → SVID revoked
  • Federated Trust: Trust domain setup → Federation configured → Cross-domain trust

State Management

  • SVID State: Valid, expired, or revoked
  • Agent State: Running or offline
  • Server State: Healthy or degraded
  • Registration State: Active or deleted

Scaling and Deployment Patterns

Horizontal Scaling

  • Agent Scaling: Deploy agent per node
  • Server Scaling: Scale server cluster
  • Identity Scaling: Handle many workloads

High Availability

  • Server HA: Multiple server instances
  • Agent HA: Redundant agent deployment
  • Federation HA: Multiple federation partners

Production Deployments

  • Server Deployment: Deploy SPIRE server cluster
  • Agent Deployment: Deploy SPIRE agent to all nodes
  • Network Configuration: Configure secure communication
  • Security Setup: Enable encryption, RBAC
  • Monitoring Setup: Configure SPIRE metrics
  • Logging Setup: Centralize SPIRE logs
  • Backup Strategy: Backup trust bundle, server state
  • Update Strategy: Plan SPIRE upgrades

Upgrade Strategies

  • Server Upgrade: Upgrade SPIRE server
  • Agent Upgrade: Upgrade SPIRE agent
  • Configuration Migration: Update configurations
  • Testing: Verify identity functionality

Resource Management

  • CPU Resources: Set server/agent CPU limits
  • Memory Resources: Configure memory limits
  • Storage Resources: Configure database storage
  • Network Resources: Configure secure network

Additional Resources

  • Official Documentation: https://spiffe.io/docs/
  • GitHub Repository: Check the project's official documentation for repository link
  • CNCF Project Page: cncf.io/projects/cncf-spiffe/
  • Community: Check the official documentation for community channels
  • Versioning: Refer to project's release notes for version-specific features

Troubleshooting

Common Issues

  1. Deployment Failures

    • Check pod logs for errors
    • Verify configuration values
    • Ensure network connectivity

  2. Performance Issues

    • Monitor resource usage
    • Adjust resource limits
    • Check for bottlenecks

  3. Configuration Errors

    • Validate YAML syntax
    • Check required fields
    • Verify environment-specific settings

  4. Integration Problems

    • Verify API compatibility
    • Check dependency versions
    • Review integration documentation

Getting Help

  • Check official documentation
  • Search GitHub issues
  • Join community channels
  • Review logs and metrics Content generated automatically. Verify against official documentation before production use.

Examples

Basic Configuration

# Basic configuration example
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{project_name}}-config
  namespace: default
data:
  # Configuration goes here
  config.yaml: |
    # Base configuration
    # Add your settings here

Kubernetes Deployment

# Kubernetes deployment for {{project_name}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{project_name}}
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{project_name}}
  template:
    metadata:
      labels:
        app: {{project_name}}
    spec:
      containers:
      - name: {{project_name}}
        image: {{project_name}}:latest
        ports:
        - containerPort: 8080
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"

Kubernetes Service

# Kubernetes service for {{project_name}}
apiVersion: v1
kind: Service
metadata:
  name: {{project_name}}
  namespace: default
spec:
  selector:
    app: {{project_name}}
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: ClusterIP

When to Use

Use this skill when:

  • Integrating a CNCF project into Kubernetes infrastructure — You need to configure, deploy, or troubleshoot a cloud-native tool within a cluster
  • Designing cloud-native architecture — You are selecting and integrating CNCF tools to solve specific infrastructure challenges
  • Resolving operational issues — A CNCF component is misbehaving, underperforming, or needs configuration changes

Core Workflow

  1. Assess Requirements — Understand the use case, scale, integration needs, and existing infrastructure. Checkpoint: Document requirements, constraints, and success criteria.

  2. Design Architecture — Plan component interactions, data flow, and deployment strategy using cloud-native best practices. Checkpoint: Verify the architecture addresses all requirements and follows CNCF conventions.

  3. Implement & Configure — Create manifests, configurations, and deployment scripts. Include resource limits, health checks, and observability hooks. Checkpoint: Validate all YAML against schema and test in a staging environment.

  4. Deploy & Monitor — Apply manifests to the cluster, verify component health, and confirm observability is working. Checkpoint: Confirm all pods/services are running, probes passing, and metrics/alerts configured.

Constraints

MUST DO

  • Include at least one complete working YAML manifest example
  • Note when content is auto-generated vs. manually verified
  • Reference relevant CNCF project documentation

MUST NOT DO

  • Deploy manifests without testing in a staging environment first
  • Use deprecated API versions (e.g., apps/v1beta1)
  • Omit resource limits and requests in Kubernetes manifests

发现更多相关技能

查看全部技能
我的收藏