The SPIFFE Project

Open source platform for X.509 certificate based service authentication and fine grained access control in dynamic infrastructures. Athenz supports provisioning and configuration (centralized authorization) use cases as well as serving/runtime (decentralized authorization) use cases.

VMware Secrets Manager is a lightweight secrets manager to protect your sensitive data. It’s perfect for edge deployments where energy and footprint requirements are strict—See more: https://vsecm.com/

SPIKE is a lightweight secrets store that uses SPIFFE as its identity control plane. It protects your secrets and helps your ops, SREs, and sysadmins manage sensitive data securely with minimal overhead.

Provides agent and server plugins for SPIRE to allow TPM 2-based node attestation.

HTTP/3-enable existing HTTP apps. Leverage HTTP3 native features and auto-enable workload identity (SPIFFE), AuthN (mTLS/x509, OIDC/Auth0-Okta), AuthZ (OPA), defense-in-depth (WAAP/WAF), and observability (metrics, logs, alerting, dashboard).

OPA-Envoy-SPIRE External Authorization Example.

vault-auth-spire is an authentication plugin for Hashicorp Vault which allows logging into Vault using a Spire provided SVID.

SPIFFE Federation the easy way

SPIFFE based Kafka authentication

A CLI for Kubernetes workload identity

SPIKE Go SDK

Showcasing the potential of SPIFFE with real-life services

Multi-Cluster Istio Service Mesh with SPIFFE/SPIRE Federation

Demo to build Service Mesh on Kubernetese using Envoy as data plane and SPIRE and OPA as control plane.

An OpenStack-based SPIRE plugins

C# library for SPIFFE support

Proof of concept SPIFFE implementation that provides user SVIDs based on web SSO integration.

Kubernetes datastore plugin for SPIRE server