SPIRE (the SPIFFE Runtime Environment)

SPIFFE and SPIRE integrate with a wide range of open-source projects, including service meshes, container runtimes, orchestrators, and security tools. Key integrations include:

• Service Meshes & Proxies: Envoy, Istio, Linkerd, NGINX, Traefik, App Mesh Controller, Emissary.
• Orchestration & Containers: Kubernetes, Docker (containerd), Dapr.
• Security & Identity: Vault, Cert-Manager, Sigstore, Ghostunnel, Keycloak, Consul, Athenz.
• Communication & CI/CD: gRPC, Tekton, Hamlet.
• Other: Parsec, Knox, Tornjak.

The vault Upstream Authority plugin allows SPIRE to sign intermediate CA certificates using the HashiCorp Vault PKI Engine.

Important Limitation: This plugin does not support the PublishJWTKey RPC. Consequently, it is not suitable for nested SPIRE topologies where JWT-SVIDs are required.

The SPIRE Server dashboards monitor the central control plane. The available dashboards include:

• Server (General): High-level status including the server's Trust Domain, Version, and Uptime.
• Server Requests: Tracks API request volumes for three key entities: Agent, Entry, and Bundle.
• Server Latency: Monitors the latency of core server processes, including Retrieval, Signing, Cache Reload, and Datastore interactions.
• Server Runtime Info: Tracks resource utilization, specifically Alloc Bytes (memory allocation) and Heap Objects.

The SPIRE Agent dashboards provide visibility into the health and performance of distributed agents. The available dashboards include:

• Agent (General): Provides a high-level overview, including the total number of agents categorized by trust domain and version.
• Agent: Detailed metrics for individual agents, specifically tracking Request Metrics (number of requests made) and Request Status (success/failure status of requests).
• Agent Latency: Monitors the timing of critical operations, including Retrieval Operations and Sync Operations.
• Agent Runtime Info: Tracks resource utilization, specifically Alloc Bytes (memory allocation) and Heap Objects.

SPIRE uses the standard Go text/template engine within various plugins to allow for dynamic configuration and data manipulation. When writing templates for SPIRE, you have access to two sets of functions:

1. Standard Go Template Functions: All built-in functions provided by the Go text/template package.
2. Sprig Library Functions: A large set of additional helper functions provided by the Sprig library.

For detailed syntax and logic, refer to the Go text/template documentation.

Denial of Service via Large Binaries

Malicious workloads can attempt to cause a Denial of Service (DoS) by forcing the SPIRE agent to perform expensive SHA256 calculations on large binaries.

Mitigation Strategies:

• Set workload_size_limit to a negative value to disable hash calculation entirely.
• Use workload_size_limit to enforce a maximum binary size for hashing.

Impact of disable_group_name_selectors

Enabling disable_group_name_selectors prevents the resolution of group SIDs to human-readable names.

Warning: If you enable this flag, any existing workload registration entries that rely on group_name selectors will stop matching. Operators should audit these entries and migrate them to use group_sid selectors before enabling this flag.

Audit log entries contain metadata about the request and the outcome of the operation.

Core Audit Fields:

• type: Always set to audit to identify the entry type.
• request_id: A UUID identifying the specific call (useful for tracking multiple logs from a single batch operation).
• status: Indicates if the call was a success or an error.
• status_code: The gRPC status code (provided on error).
• status_message: The error message returned to the caller (provided on error).

Caller Identification (UDS Endpoints): When using Unix Domain Socket (UDS) endpoints, the following fields identify the caller:

• caller_uid: Caller user ID.
• caller_gid: Caller group ID.
• caller_path: Path to the caller's binary file.

Note for Kubernetes users: To enable audit logging for UDS endpoint calls in Kubernetes, the SPIRE Server node must have hostPID: true configured.

The plugin must identify which SPIRE server instance is managing which keys. It uses Azure Key Vault tags with the spire- prefix to track these.

To identify the server, choose one of the following:

• Key Identifier File (key_identifier_file): The plugin automatically manages and persists the server ID in this file. This is the recommended approach for most situations. Warning: If this file is lost, the plugin cannot identify previously managed keys and will recreate new keys on demand.
• Static Identifier (key_identifier_value): Use this to specify a static identifier if a file cannot be persisted. This provides more manual control over the server identity.

Managed tags include:

• spire-server-td: The trust domain name of the server.
• spire-server-id: The unique identifier for the server (derived from the file or static value).

The plugin must identify the specific server instance to manage its keys. You have two options:

1. Key Identifier File (key_identifier_file): The plugin manages the identifier automatically by storing a server ID in the specified file. If the file is missing at startup, it is recreated with a new ID. Warning: If this file is lost, the plugin cannot identify previously managed keys and will create new ones.
2. Key Identifier Value (key_identifier_value): A static string used as the server identifier. Use this if the server cannot persist a local file.

The SQL plugin uses Go's database/sql package for connection management. You can tune the following settings to optimize performance:

• max_open_conns: Limits the total number of open connections to the database (default: 100).
• max_idle_conns: Limits the number of connections kept in the idle pool (default: 100).
• conn_max_lifetime: Sets the maximum duration a connection can be reused before being closed (default: unlimited).

Note: The plugin uses an internal, non-configurable default of 30 seconds for ConnMaxIdleTime (the maximum amount of time a connection may be idle before being closed).