1 of 25

SPIRE FEDERATION: GALADRIEL

Maxi Churichi - Argentina - HPE

Juliano Fantozzi - Brazil - HPE

¹

This is a sample Picture with Caption slide ideal for including a picture with a brief descriptive statement.

To Replace the Picture on this Sample Slide (this applies to all slides in this template that contain replaceable pictures)

Select the sample picture and press Delete. Click the icon inside the shape to open the Insert Picture dialog box. Navigate to the location where the picture is stored, select desired picture and click on the Insert button to fit the image proportionally within the shape.

Note: Do not right-click the image to change the picture inside the picture placeholder. This will change the frame size of the picture placeholder. Instead, follow the steps outlined above.

Tip: use the Crop tool to reposition a picture within a placeholder. From the Picture Tools Format tab on the ribbon, click the Crop button. Click and drag the picture within the placeholder to reposition. To scale the picture within the placeholder (while Crop is active), grab a round corner handle and drag to resize. Hold Shift key to constrain picture aspect ratio when resizing.

2 of 25

THE TALK

The WHAT:

SPIRE Federation

The HOW

How does SPIRE Federation work?

The WHY

Current limitations
How is Federation being approached?

The proposed new HOW

GALADRIEL
DEMO

The NEXT

What's next?

²

3 of 25

THE WHAT: SPIRE FEDERATION

³

This is a sample Picture with Caption slide ideal for including a picture with a brief descriptive statement.

To Replace the Picture on this Sample Slide (this applies to all slides in this template that contain replaceable pictures)

Select the sample picture and press Delete. Click the icon inside the shape to open the Insert Picture dialog box. Navigate to the location where the picture is stored, select desired picture and click on the Insert button to fit the image proportionally within the shape.

Note: Do not right-click the image to change the picture inside the picture placeholder. This will change the frame size of the picture placeholder. Instead, follow the steps outlined above.

Tip: use the Crop tool to reposition a picture within a placeholder. From the Picture Tools Format tab on the ribbon, click the Crop button. Click and drag the picture within the placeholder to reposition. To scale the picture within the placeholder (while Crop is active), grab a round corner handle and drag to resize. Hold Shift key to constrain picture aspect ratio when resizing.

4 of 25

SPIFFE – SPIRE FEDERATION

Allows secure communications between services that are in different trust domains

⁴

SPIRE Server A

SPIRE Server B

SPIRE Agent

Workload A

Workload B

Federation�

(Servers constantly

exchange trust bundles)

5 of 25

CURRENT SPIRE FEDERATION

Manual configuration
Federation API

⁵

Exposing the trust bundle via end-point

Defining relationships

6 of 25

HOW DOES CURRENT SPIRE FEDERATION WORK?

⁶

SPIRE A

SPIRE B

4. Trust Bundle A

4. Trust Bundle B

1. Endpoint configuration

2. Federation configuration

3. Trust bundle setting

1. Endpoint configuration

2. Federation configuration

3. Trust bundle setting

7 of 25

THE WHY: CURRENT LIMITATIONS

⁷

This is a sample Picture with Caption slide ideal for including a picture with a brief descriptive statement.

To Replace the Picture on this Sample Slide (this applies to all slides in this template that contain replaceable pictures)

Select the sample picture and press Delete. Click the icon inside the shape to open the Insert Picture dialog box. Navigate to the location where the picture is stored, select desired picture and click on the Insert button to fit the image proportionally within the shape.

Note: Do not right-click the image to change the picture inside the picture placeholder. This will change the frame size of the picture placeholder. Instead, follow the steps outlined above.

Tip: use the Crop tool to reposition a picture within a placeholder. From the Picture Tools Format tab on the ribbon, click the Crop button. Click and drag the picture within the placeholder to reposition. To scale the picture within the placeholder (while Crop is active), grab a round corner handle and drag to resize. Hold Shift key to constrain picture aspect ratio when resizing.

8 of 25

FEDERATION TODAY

⁸

SPIRE

Federation requires both servers to expose a port for accessing bundles
Scalability
There is no central way to audit all the federation relationships inside an organization

9 of 25

SOME OF THE CURRENT FEDERATION APPROACHES

Direct peer to peer

Either HTTPS or HTTPS+SPIFFE supported

Sharing via an object store (S3 bucket, Vault, etc.)
Via a VPN or tunnel
SPIRE Controller Manager

⁹

10 of 25

GALADRIEL – A SPIRE FEDERATION ALTERNATIVE

¹⁰

This is a sample Picture with Caption slide ideal for including a picture with a brief descriptive statement.

To Replace the Picture on this Sample Slide (this applies to all slides in this template that contain replaceable pictures)

Select the sample picture and press Delete. Click the icon inside the shape to open the Insert Picture dialog box. Navigate to the location where the picture is stored, select desired picture and click on the Insert button to fit the image proportionally within the shape.

Note: Do not right-click the image to change the picture inside the picture placeholder. This will change the frame size of the picture placeholder. Instead, follow the steps outlined above.

Tip: use the Crop tool to reposition a picture within a placeholder. From the Picture Tools Format tab on the ribbon, click the Crop button. Click and drag the picture within the placeholder to reposition. To scale the picture within the placeholder (while Crop is active), grab a round corner handle and drag to resize. Hold Shift key to constrain picture aspect ratio when resizing.

11 of 25

FEDERATION WITH GALADRIEL

¹¹

SPIRE

GALADRIEL

SPIRE

Galadriel is a central point that collects trust bundles and shares them with SPIRE servers

12 of 25

FEDERATION WITH GALADRIEL

¹²

SPIRE

GALADRIEL

SPIRE

Galadriel is a central point that collects trust bundles and shares them with SPIRE servers

SPIRE

13 of 25

GALADRIEL

WHAT IS

Alternative approach to federation
Multi-tenant
Federation at scale

WHAT IS NOT

A replacement of current SPIRE federation
A SPIRE plugin

¹³

14 of 25

DESIGN CONSIDERATIONS

¹⁴

Galadriel Server synchronizes all connected Harvesters
Galadriel Harvesters run alongside their SPIRE server
Easy to deploy and manage

SPIRE SERVER

GALADRIEL SERVER

HARVESTER

15 of 25

SECURITY CONSIDERATIONS

¹⁵

Never concatenate bundles
Federation relationships are kept secure in the database
No sensitive material being sent over the network
End-to-end signature verification of bundles
Multitenancy

16 of 25

DEMO MAP

¹⁶

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

17 of 25

DEMO MAP

¹⁷

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

18 of 25

DEMO MAP

¹⁸

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

2

19 of 25

DEMO MAP

¹⁹

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

2

3

20 of 25

DEMO MAP

²⁰

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

2

3

4

21 of 25

DEMO MAP

²¹

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

2

3

4

5

22 of 25

DEMO MAP

²²

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

2

3

4

5

6+7

23 of 25

DEMO MAP

DEMO TIME!

²³

SPIRE A

SPIRE B

Galadriel Server

Galadriel Harvester

REST

UDS

REST

Members

Relationships

SPIRE Agent

Greeter Server

SPIRE Agent

Greeter Client

1

2

3

4

5

6+7

24 of 25

NEXT STEPS

Working on an MVP for first half of 2023
Finalize end-to-end verification design

²⁴

25 of 25

SUPPORTING DOCS

GitHub: https://github.com/HewlettPackard/galadriel

Design document: https://bit.ly/galadriel-rfc-design-doc

Blog: https://developer.hpe.com/blog/galadriel-a-spire-federation-alternative/

²⁵