SPIRE Component Overview

SPIRE Component Overview An architecture diagram generated by Archify. SPIRE Controller Manager · Watches ClusterSPIFFEID · Architecture component SPIRE Controller Manager Watches ClusterSPIFFEID Data store · Entries and CA state · Control plane Data store Entries and CA state SPIRE Server · Registration API · Node Attestation · Control plane SPIRE Server Registration API · Node Attestation SPIRE Signing Keys · CA · JWT key manager · Control plane SPIRE Signing Keys CA · JWT key manager SPIRE Agent · Workload API · SVID cache · Kubernetes Node 1 SPIRE Agent Workload API · SVID cache SPIRE Agent · Workload API · SVID cache · Kubernetes Node 2 SPIRE Agent Workload API · SVID cache Workload Pod A · Kubernetes Node 1 Workload Pod A Workload Pod B · Kubernetes Node 1 Workload Pod B Workload Pod C · Kubernetes Node 2 Workload Pod C Workload Pod D · Kubernetes Node 2 Workload Pod D Manages registration entries Persistent data Signs SVIDs Node attestation · SVID requests Node attestation · SVID requests Workload API Workload API Control plane Kubernetes Node 1 Kubernetes Node 2 Legend Workloads Data store SPIRE components Registration automation

SPIRE Server

  • • X.509-SVID: SPIRE CA signs leaf certificates
  • • JWT-SVID: server JWT signing key
  • • Upstream CA: signs SPIRE intermediate CA
  • • Distinguish DataStore from KeyManager persistence

SPIRE Agent

  • • Workload API/SDS attest the calling process
  • • CSI mounts an API socket, not certificate files
  • • Cache, renew, and update trust bundles
  • • Application authentication and authorization remain separate