Practice (60 min) — kind cluster

1. Deploy SPIRE (server + agent DaemonSet) with the k8s_psat node attestor. Create registration entries for three workloads.
2. Deploy a tiny Go/Python client and server using go-spiffe / py-spiffe that fetch X.509-SVIDs from the Workload API and do mTLS. Confirm the server logs the client's SPIFFE ID.
3. Try to get workload A's SVID from workload B's pod — confirm the agent gives B its own identity, not A's (attestation is per-process).
4. Install Istio (or Linkerd) with SPIRE integration; enable strict mTLS; write an AuthorizationPolicy scoping orders-api to bff's principal. Call from web (403) and bff (200).
5. Rotate: shorten the SVID TTL to 2 minutes; watch SVIDs auto-renew with no downtime.
6. Set up SPIFFE Federation between two trust domains (two kind clusters) and verify a cross-domain mTLS call.

Build it in Go (40 min) — SPIFFE-style identity with only the standard library

SPIRE issues and rotates the certificates. What a service has to do is small and worth seeing in code: require mTLS, pull the SPIFFE ID out of the peer certificate's URI SAN, check the trust domain, and authorize by ID.

// spiffe: workload identity the SPIFFE way, with only the standard library.
// A trust domain's CA issues short-lived certificates whose identity is a URI
// SAN (spiffe://shop.example/ns/prod/sa/orders). Services authenticate each
// other with mTLS and authorize by that ID -- not by IP, not by hostname.
//
//	go run ./spiffe
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"errors"
	"fmt"
	"io"
	"log"
	"math/big"
	"net"
	"net/http"
	"net/url"
	"slices"
	"strings"
	"time"
)

type ca struct {
	cert *x509.Certificate
	key  *ecdsa.PrivateKey
}

func newCA(name string) *ca {
	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	tmpl := &x509.Certificate{
		SerialNumber: serial(), Subject: pkix.Name{CommonName: name},
		NotBefore: time.Now().Add(-time.Minute), NotAfter: time.Now().Add(24 * time.Hour),
		IsCA: true, BasicConstraintsValid: true,
		KeyUsage: x509.KeyUsageCertSign,
	}
	der, _ := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	c, _ := x509.ParseCertificate(der)
	return &ca{c, key}
}

// issue mints an SVID: a 1-hour certificate whose ONLY identity is the URI.
func (a *ca) issue(spiffeID string) tls.Certificate {
	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	u, _ := url.Parse(spiffeID)
	tmpl := &x509.Certificate{
		SerialNumber: serial(),
		NotBefore:    time.Now().Add(-time.Minute),
		NotAfter:     time.Now().Add(time.Hour), // short-lived: rotation replaces revocation
		URIs:         []*url.URL{u},
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
	}
	der, _ := x509.CreateCertificate(rand.Reader, tmpl, a.cert, &key.PublicKey, a.key)
	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
}

// spiffeID extracts the workload identity from a verified peer certificate.
func spiffeID(cs tls.ConnectionState) (string, error) {
	if len(cs.PeerCertificates) == 0 || len(cs.PeerCertificates[0].URIs) != 1 {
		return "", errors.New("no SPIFFE ID")
	}
	u := cs.PeerCertificates[0].URIs[0]
	if u.Scheme != "spiffe" || u.Host != "shop.example" {
		return "", fmt.Errorf("foreign trust domain %q", u.Host)
	}
	return u.String(), nil
}

func main() {
	trust := newCA("shop.example trust domain")
	pool := x509.NewCertPool()
	pool.AddCert(trust.cert)

	// The payments service: mTLS required, then an allow-list of callers.
	allowed := []string{"spiffe://shop.example/ns/prod/sa/orders"}
	srv := &http.Server{
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			id, err := spiffeID(*r.TLS)
			if err != nil || !slices.Contains(allowed, id) {
				http.Error(w, "forbidden: "+id, http.StatusForbidden) // authenticated, not authorized
				return
			}
			fmt.Fprintf(w, "charge accepted for caller %s", id)
		}),
		TLSConfig: &tls.Config{
			Certificates: []tls.Certificate{trust.issue("spiffe://shop.example/ns/prod/sa/payments")},
			ClientAuth:   tls.RequireAndVerifyClientCert, // no client cert, no handshake
			ClientCAs:    pool,
			MinVersion:   tls.VersionTLS13,
		},
		ErrorLog: log.New(io.Discard, "", 0), // the clients below report the outcome
	}
	ln, _ := net.Listen("tcp", "127.0.0.1:0")
	go srv.ServeTLS(ln, "", "")
	addr := "https://" + ln.Addr().String() + "/charge"

	call := func(label string, cert *tls.Certificate) {
		cfg := &tls.Config{RootCAs: pool, MinVersion: tls.VersionTLS13,
			// The client verifies the SERVER's SPIFFE ID too: mutual, not one-way.
			InsecureSkipVerify: true, // hostname checks don't apply to SPIFFE IDs...
			VerifyConnection: func(cs tls.ConnectionState) error { // ...so verify chain + ID ourselves
				opts := x509.VerifyOptions{Roots: pool, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}}
				if _, err := cs.PeerCertificates[0].Verify(opts); err != nil {
					return err
				}
				if id, err := spiffeID(cs); err != nil || id != "spiffe://shop.example/ns/prod/sa/payments" {
					return fmt.Errorf("unexpected server identity %q", id)
				}
				return nil
			},
		}
		if cert != nil {
			// Send the certificate unconditionally. (With cfg.Certificates, Go's
			// client quietly sends NOTHING if the cert isn't from a CA the server
			// asked for -- an attacker's client won't be so polite.)
			cfg.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
				return cert, nil
			}
		}
		c := &http.Client{Transport: &http.Transport{TLSClientConfig: cfg}, Timeout: 3 * time.Second}
		resp, err := c.Post(addr, "text/plain", nil)
		if err != nil {
			var ue *url.Error
			if errors.As(err, &ue) {
				err = ue.Err
			}
			fmt.Printf("%-40s -> rejected in the TLS handshake: %v\n", label, err)
			return
		}
		body, _ := io.ReadAll(resp.Body)
		resp.Body.Close()
		fmt.Printf("%-40s -> %d %s\n", label, resp.StatusCode, strings.TrimSpace(string(body)))
	}

	orders := trust.issue("spiffe://shop.example/ns/prod/sa/orders")
	reports := trust.issue("spiffe://shop.example/ns/prod/sa/reports")
	attacker := newCA("attacker CA").issue("spiffe://shop.example/ns/prod/sa/orders")

	call("orders (allowed ID)", &orders)
	call("reports (valid cert, wrong ID)", &reports)
	call("forged orders ID from another CA", &attacker)
	call("no client certificate", nil)
}

func serial() *big.Int {
	n, _ := rand.Int(rand.Reader, big.NewInt(1<<62))
	return n
}

$ go run ./spiffe
orders (allowed ID)                      -> 200 charge accepted for caller spiffe://shop.example/ns/prod/sa/orders
reports (valid cert, wrong ID)           -> 403 forbidden: spiffe://shop.example/ns/prod/sa/reports
forged orders ID from another CA         -> rejected in the TLS handshake: remote error: tls: unknown certificate authority
no client certificate                    -> rejected in the TLS handshake: remote error: tls: certificate required

What to notice:

• Authentication and authorization are separate outcomes. reports has a perfectly valid SVID from our trust domain, so the handshake succeeds, and it still gets a 403 because it isn't on the allow-list. A mesh that only "turns on mTLS" gives you the first half.
• Identity is the URI, not the hostname or IP. That's why the client sets InsecureSkipVerify and re-implements verification in VerifyConnection: hostname checks don't apply to SPIFFE IDs, but chain verification and the ID check absolutely must. Copying only the first line of that pattern is a serious bug.
• A finding from building this lab: given a certificate from a CA the server didn't ask for, Go's TLS client silently sends no certificate, so the server sees "certificate required" rather than "unknown authority". The lab uses GetClientCertificate so the forged certificate is really presented, as an attacker's client would.
• One-hour lifetimes stand in for revocation, exactly as with SPIRE.

Exercises:

1. Load the trust bundle and SVID from files and reload them on change (rotation every 30 minutes), using the GetCertificate pattern from the TCP/IP guide's certreload lab.
2. Replace the allow-list with a call to the Chapter 25 policy engine: check("api:payments#caller@spiffe://...").
3. Compare with github.com/spiffe/go-spiffe/v2, which does the same against a live SPIRE agent's Workload API.