Advanced18 min

Workload Identity

Giving ephemeral services a strong, short-lived, platform-attested identity — no secrets in config.

By the end of this lesson, explain how workloads get identity without static secrets, using SPIFFE and cloud IAM.

How deep?

How the pieces actually move.

Workloads — pods, functions, VMs — are created and destroyed constantly. Handing each a static secret doesn't scale and leaks everywhere. Workload identity gives each running workload a short-lived, automatically-issued credential tied to what the platform can *attest* about it, so there are no secrets in config at all.

First, the whole system

First, see the whole system. Then we’ll open it up.

Attestation to credential

A workload presents platform-attested facts to an identity issuer.
The issuer verifies them and returns a short-lived credential (SPIFFE SVID or cloud token).
The workload uses it (mTLS or bearer token) to call other services.

flowchart LR
  wl[Workload] -->|proves platform facts| att[Attestation]
  att -->|verified by| issuer[Identity issuer / SPIRE / cloud IAM]
  issuer -->|short-lived SVID / token| wl
  wl -->|mTLS or token| peer[Other services]

SPIFFE / SVID: SPIFFE defines a universal workload identity (a spiffe:// ID). An SVID is the credential (X.509 cert or JWT) proving it. SPIRE is a common implementation that handles attestation and rotation.

Why it exists

You know what happens. Now see why it works.

It closes the biggest non-human identity hole: long-lived secrets in environment variables and config files. If the credential is short-lived and derived from attestation, a leaked pod filesystem yields a credential that's already expiring and can't be re-minted off-platform.

Over-broad workload permissions

Trigger: A workload identity is granted more scope than the workload needs (or shares a role with many workloads).
Symptom: Compromising one workload grants access far beyond its function.
Blast radius: Lateral movement across everything the shared role can reach.
Mitigation: Per-workload identities, least privilege, and scoped, short-lived credentials.

Deep dive: Privilege Escalation

Operational complexity

Workload identity removes secret sprawl and shrinks blast radius, but adds an attestation/issuance system (SPIRE, cloud IAM) as critical infrastructure. The payoff — no static secrets, automatic rotation — is why zero-trust architectures adopt it.

How it connects

What does the identity issuer trust instead of a stored secret?

Platform attestation — the runtime platform vouches for the workload's identity, so no long-lived secret needs to exist.