Traditional approaches of secrets management in enterprise rely on distributing and rotating long-lived credentials, a practice that conflicts with zero-trust principles and increases operational risk. The Secure Production Identity Framework for Everyone (SPIFFE) and its implementation, SPIRE, a graduated CNCF project, solves this by issuing short-lived workload identities as x.509 certificates or JWTs.

In this beginner-friendly session, we will introduce core concepts of SPIFFE and SPIRE and how they replace static credentials with dynamic workload identities. We will then dive into how Keycloak’s new SPIFFE Identity Provider feature enables an integration with SPIRE. We will walk though how to configure SPIRE and Keycloak to allow seamless authentication of workloads using SPIRE-issued JWT SVIDs.