Lesson 10 of 12 · 6 min read
Workload Identity and SPIFFE: Identity for Services, Pipelines and Agents
Services, CI jobs and AI agents have traditionally used long-lived stored keys, which leak and outlive their purpose. Workload identity replaces them with short-lived credentials issued after the platform attests what the workload is: Kubernetes projected tokens, OIDC tokens from CI exchanged for cloud credentials, and SPIFFE identities with X.509 or JWT documents for service-to-service mutual TLS. The design questions are which claims a trust policy pins, how attestation roots the chain, and remembering that identity is not authorization: every service still needs policy on what each identity may do.
free sign-in, no card required
Practise it as an interviewer asks it
Why does network segmentation matter, and how would you segment an environment, from VLANs to microsegmentation?How do services authenticate to each other without long-lived secrets?How would you secure remote access: a traditional VPN or zero-trust network access? What attacks target each?Design mutual TLS between internal services. How does its trust model differ from the web PKI?What are sender-constrained tokens, such as DPoP and mutual TLS binding, and when are they worth it?What does zero trust mean in practice, beyond the slogan?