SPIFFE
ELI5 - The Vibe Check
SPIFFE gives every workload in your system a passport that isn't tied to an IP address or a hostname, but to who it actually is: "I am the payments service, running in this cluster, deployed by this pipeline." Services can check each other's passports before talking, so even if an attacker gets onto your network, they can't just pretend to be a service they aren't.
Real Talk
SPIFFE (Secure Production Identity Framework For Everyone) is an open standard for issuing cryptographically verifiable identities, called SVIDs, to software workloads, independent of network location. SPIRE is the reference implementation that issues and rotates these identities automatically, forming the identity layer that many zero trust and mTLS service mesh deployments are built on.
When You'll Hear This
"The mesh uses SPIFFE identities instead of IP allowlists for service-to-service auth." / "SPIRE rotates the workload certs automatically, so nobody's holding a long-lived cert by hand."
Related Terms
Certificate
A certificate is a digital ID card for a website, signed by a trusted authority.
Istio
Istio is a service mesh that manages how microservices talk to each other.
mTLS
Normal TLS: you check that the website is legit. mTLS: you BOTH check each other. The server verifies your certificate, you verify the server's.
Service Mesh
In a microservices system, every service needs to handle retries, timeouts, mutual TLS, and send traces. You could code all that in every service.
Zero Trust
Zero trust means 'never trust, always verify' — even if a request comes from inside your network.