CNCF · date: see source
SPIFFE (CNCF); SVIDs via SPIRE
If the agent is deployed as a service, SPIFFE is how you stop putting API keys in env vars. It does not, by itself, express 'this call is on behalf of Alice'.
At a glance
Actors
01
Workloads need automatically provisioned, short-lived cryptographic identities without bootstrap secrets, attested from platform properties (Kubernetes service account, Unix process, …). If the agent is deployed as a service, SPIFFE is how you stop putting API keys in env vars. It does not, by itself, express 'this call is on behalf of Alice'.
02
SPIRE server is the identity issuer for a trust domain. SPIRE agents attest workloads and issue SVIDs via the Workload API (often a Unix socket). Trust bundles distribute federation. JWT-SVIDs are bearer-ish unless combined with extra PoP — prefer X.509 mTLS or WPT-style proofs for agents.
03
Not an IETF RFC. CNCF. SPIFFE ID: spiffe://<trust-domain>/<path> — a WIMSE-conforming identifier. X.509-SVID for mTLS; JWT-SVID for app-layer. Rotation replaces revocation as the primary control. Federation via trust bundles, not OAuth DCR.
04
Flow 1
SPIRE agent attests the workload via platform selectors.
Workload API (Unix socket) returns X.509-SVID or JWT-SVID plus trust bundle.
Workload uses X.509 for mTLS to a tool, or presents JWT-SVID with additional PoP if app-layer.
If also acting for a user, obtain an OAuth token separately and send both.
05
Workload identity and authentication. Authorization is OPA/policy/OAuth on top. User identity is not in the SVID.
06
IETF generalization of multi-system aspects.
WIT/WIC align with SVID practice.
How the SVID authenticates to an OAuth AS.
Certificate-bound OAuth tokens on top of X.509-SVID.
Recommended agent-as-workload identity.
07
Treat it like a stolen-able token unless you add PoP. Prefer mTLS.
A stolen user OAuth token presented by a different binary is a different incident — keep workload identity even when you have OAuth.
08
CNCF protocol, production-proven, not an RFC. https://spiffe.io/ WIMSE is the IETF track for multi-system pieces.
Not an IETF RFC. Production-proven. WIMSE is the IETF effort to generalize multi-system aspects. JWT-SVIDs are bearer-ish unless combined with extra PoP — prefer X.509 mTLS or WPT-style proofs for agents.