SPIRE Federation Architecture

SPIRE Federation Architecture An architecture diagram generated by Archify. Workload A · us-east.example.com · Trust Domain A · us-east.example.com Workload A us-east.example.com SPIRE Server A · federation enabled · Trust Domain A · us-east.example.com SPIRE Server A federation enabled Bundle Store A · Per-domain bundles · Trust Domain A · us-east.example.com Bundle Store A Per-domain bundles Bundle Endpoint A · :8443 · Federation setup Bundle Endpoint A :8443 Bundle Endpoint B · :8443 · Federation setup Bundle Endpoint B :8443 Workload B · eu-west.example.com · Trust Domain B · eu-west.example.com Workload B eu-west.example.com SPIRE Server B · federation enabled · Trust Domain B · eu-west.example.com SPIRE Server B federation enabled Bundle Store B · Per-domain bundles · Trust Domain B · eu-west.example.com Bundle Store B Per-domain bundles SVID via agent store Bundle B publish bundle Explicit trust setup publish bundle SVID via agent store Bundle A mTLS + peer ID authorization Trust Domain A · us-east.example.com Trust Domain B · eu-west.example.com Federation setup Legend Backend Database Cloud Security

Trust bootstrap

  • • https_spiffe: initial bundle + endpointSPIFFEID
  • • https_web: validate DNS/TLS certificate chain
  • • Importing a bundle does not rotate a CA key

Scope

  • • federatesWith: only required workload trust domains
  • • Separate JWT audience/expiry checks from replay defenses
  • • Apply service authorization after authentication