Advanced Workload Attestation: TPM and Cloud Provider Security for SPIFFE/SPIRE

Introduction: Beyond Basic Kubernetes Attestation#

In our previous guides, we’ve focused primarily on Kubernetes PSAT (Projected Service Account Token) attestation—a solid foundation for most cloud-native workloads. However, enterprise environments often require more sophisticated attestation methods that leverage hardware security modules, cloud provider credentials, or multi-factor attestation strategies.

This comprehensive guide explores advanced workload attestation patterns using TPM (Trusted Platform Module) hardware, cloud provider instance identity documents, and hybrid attestation strategies that provide defense-in-depth for critical workloads.

Understanding Advanced Attestation Architecture#

Let’s visualize the different attestation layers available in SPIFFE/SPIRE:

1
graph TB
2
    subgraph "Attestation Hierarchy"
3
        subgraph "Hardware Layer"
4
            TPM[TPM 2.0 Chip]
5
            HSM[Hardware Security Module]
6
            FIPS[FIPS 140-2 Compliance]
7
        end
8

9
        subgraph "Platform Layer"
10
            AWS[AWS Instance Identity]
11
            GCP[GCP Instance Identity]
12
            AZURE[Azure Instance Metadata]
13
            VSPHERE[vSphere vCenter]
14
        end
15

16
        subgraph "Runtime Layer"
17
            K8S[Kubernetes PSAT]
18
            UNIX[Unix Process]
19
            X509[X.509 Certificates]
20
        end
21

22
        subgraph "Network Layer"
23
            JWT[JWT Tokens]
24
            OIDC[OIDC Discovery]
25
            MTLS[mTLS Bootstrap]
26
        end
27
    end
28

29
    subgraph "SPIRE Components"
30
        SERVER[SPIRE Server]
31
        AGENT[SPIRE Agent]
32
        WORKLOAD[Workload]
33
    end
34

35
    TPM --> AGENT
36
    AWS --> AGENT
37
    K8S --> AGENT
38
    JWT --> WORKLOAD
39

40
    AGENT --> SERVER
41
    SERVER --> WORKLOAD
42

43
    style TPM fill:#ff9999
44
    style AWS fill:#ffcc99
45
    style K8S fill:#99ff99
46
    style JWT fill:#99ccff

Why Advanced Attestation Matters#

Regulatory Compliance: FIPS 140-2, Common Criteria, SOC 2 requirements
Zero Trust Architecture: Multiple attestation factors reduce attack surface
Cloud Security: Leverage platform-native security features
Hardware Root of Trust: TPM provides tamper-resistant foundation
Auditability: Hardware-backed attestation provides stronger audit trails

TPM (Trusted Platform Module) Attestation#

TPM attestation provides the strongest security guarantee by leveraging hardware-based cryptographic capabilities that are resistant to software attacks.

Understanding TPM Architecture#

1
graph TB
2
    subgraph "TPM 2.0 Chip"
3
        EK[Endorsement Key<br/>Factory Installed]
4
        SRK[Storage Root Key<br/>Generated]
5
        AIK[Attestation Identity Key<br/>For Quotes]
6
        PCR[Platform Configuration Registers<br/>Boot Measurements]
7
    end
8

9
    subgraph "SPIRE Agent"
10
        TPMPLUGIN[TPM Attestor Plugin]
11
        MEASURE[Boot Measurement]
12
        QUOTE[TPM Quote Generation]
13
    end
14

15
    subgraph "SPIRE Server"
16
        VERIFY[Quote Verification]
17
        POLICY[Attestation Policy]
18
        TRUST[Trust Decision]
19
    end
20

21
    EK --> SRK
22
    SRK --> AIK
23
    PCR --> QUOTE
24
    AIK --> QUOTE
25

26
    TPMPLUGIN --> MEASURE
27
    MEASURE --> PCR
28
    QUOTE --> VERIFY
29
    VERIFY --> POLICY
30
    POLICY --> TRUST
31

32
    style EK fill:#ff9999
33
    style PCR fill:#ffcc99
34
    style VERIFY fill:#99ff99

TPM Node Attestor Configuration#

Let’s configure TPM attestation for SPIRE:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-server-tpm-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      bind_address = "0.0.0.0"
10
      bind_port = "8081"
11
      socket_path = "/tmp/spire-server/private/api.sock"
12
      trust_domain = "enterprise.example.com"
13
      data_dir = "/run/spire/data"
14
      log_level = "INFO"
15

16
      # TPM CA configuration
17
      ca_subject = {
18
        country = ["US"],
19
        organization = ["Example Corp"],
20
        common_name = "SPIRE Server CA with TPM",
21
      }
22

23
      # Default SVID TTL
24
      default_svid_ttl = "1h"
25

26
      # JWT issuer configuration
27
      jwt_issuer = "https://oidc.enterprise.example.com"
28
    }
29

30
    plugins {
31
      # TPM Node Attestor
32
      NodeAttestor "tpm" {
33
        plugin_data {
34
          # Path to TPM device (usually /dev/tpm0 or /dev/tpmrm0)
35
          tpm_path = "/dev/tpmrm0"
36

37
          # Hash algorithm for PCR measurements
38
          hash_algorithm = "sha256"
39

40
          # Required PCR values for attestation
41
          # PCR 0: BIOS/UEFI measurements
42
          # PCR 1: BIOS configuration
43
          # PCR 2: Option ROM measurements
44
          # PCR 7: Secure boot measurements
45
          pcr_selections {
46
            hash_alg = "sha256"
47
            pcr_ids = [0, 1, 2, 7]
48
          }
49

50
          # Expected PCR values (base64 encoded)
51
          expected_pcr_values {
52
            "0" = "d2b2c8e5f4a3b9d7c6e8f1a4b7c9e2f5d8a1b4c7e0f3a6b9c2e5f8a1b4c7e0f3"
53
            "1" = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
54
            "2" = "f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2"
55
            "7" = "c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5"
56
          }
57

58
          # Allow list of endorsement key certificates
59
          # These would be obtained from the TPM manufacturer
60
          allowed_ek_certs = [
61
            "/etc/spire/certs/tpm-ek-cert-1.pem",
62
            "/etc/spire/certs/tpm-ek-cert-2.pem"
63
          ]
64

65
          # Require secure boot
66
          require_secure_boot = true
67

68
          # Anti-replay protection window
69
          attestation_cache_ttl = "300s"
70
        }
71
      }
72

73
      # TPM Workload Attestor
74
      WorkloadAttestor "tpm" {
75
        plugin_data {
76
          # Path to TPM device
77
          tpm_path = "/dev/tpmrm0"
78

79
          # Workload PCR for runtime measurements
80
          workload_pcr = 23
81

82
          # Measurement policy
83
          measurement_policy {
84
            # Require specific executable hashes
85
            required_measurements = [
86
              "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
87
            ]
88

89
            # Allow dynamic library measurements
90
            allow_dynamic_libraries = false
91
          }
92
        }
93
      }
94

95
      DataStore "sql" {
96
        plugin_data {
97
          database_type = "postgres"
98
          connection_string = "dbname=spire user=spire host=postgres-ha.data.svc.cluster.local sslmode=require"
99
        }
100
      }
101

102
      KeyManager "disk" {
103
        plugin_data {
104
          keys_path = "/run/spire/data/keys.json"
105
        }
106
      }
107

108
      UpstreamAuthority "disk" {
109
        plugin_data {
110
          cert_file_path = "/run/spire/ca/ca.crt"
111
          key_file_path = "/run/spire/ca/ca.key"
112
        }
113
      }
114

115
      # Notifier for updating Kubernetes trust bundles
116
      Notifier "k8sbundle" {
117
        plugin_data {
118
          webhook_label = "spiffe.io/webhook"
119
        }
120
      }
121
    }
122

123
    health_checks {
124
      listener_enabled = true
125
      bind_address = "0.0.0.0"
126
      bind_port = "8080"
127
      live_path = "/live"
128
      ready_path = "/ready"
129
    }
130

131
    telemetry {
132
      Prometheus {
133
        bind_address = "0.0.0.0"
134
        bind_port = "9988"
135
      }
136
    }
137
---
138
# TPM SPIRE Agent Configuration
139
apiVersion: v1
140
kind: ConfigMap
141
metadata:
142
  name: spire-agent-tpm-config
143
  namespace: spire-system
144
data:
145
  agent.conf: |
146
    agent {
147
      data_dir = "/run/spire/data"
148
      log_level = "INFO"
149
      server_address = "spire-server.spire-system"
150
      server_port = "8081"
151
      socket_path = "/run/spire/sockets/agent.sock"
152
      trust_bundle_path = "/run/spire/bundle/bundle.crt"
153
      trust_domain = "enterprise.example.com"
154

155
      # Insecure bootstrap for initial trust
156
      insecure_bootstrap = false
157

158
      # Join token for bootstrap (one-time use)
159
      # join_token = "bootstrap-token-12345"
160
    }
161

162
    plugins {
163
      # TPM Node Attestor
164
      NodeAttestor "tpm" {
165
        plugin_data {
166
          # TPM device path
167
          tpm_path = "/dev/tpmrm0"
168

169
          # Hash algorithm
170
          hash_algorithm = "sha256"
171

172
          # Ownership authentication (if required)
173
          # owner_auth = "your-tpm-owner-password"
174

175
          # PCR selection for node attestation
176
          pcr_selections {
177
            hash_alg = "sha256"
178
            pcr_ids = [0, 1, 2, 7]
179
          }
180

181
          # Generate quote on startup
182
          generate_quote_on_startup = true
183

184
          # Cache attestation results
185
          cache_attestation = true
186
          cache_ttl = "3600s"
187
        }
188
      }
189

190
      # TPM Workload Attestor
191
      WorkloadAttestor "tpm" {
192
        plugin_data {
193
          tpm_path = "/dev/tpmrm0"
194
          workload_pcr = 23
195

196
          # Measure workload on startup
197
          measure_on_startup = true
198

199
          # Workload measurement policy
200
          measurement_policy {
201
            # Executable path whitelist
202
            allowed_executables = [
203
              "/usr/bin/my-secure-app",
204
              "/opt/enterprise/secure-service"
205
            ]
206

207
            # Require code signing verification
208
            require_code_signing = true
209

210
            # Trusted signers
211
            trusted_signers = [
212
              "CN=Enterprise Code Signing,O=Example Corp,C=US"
213
            ]
214
          }
215
        }
216
      }
217

218
      # Kubernetes Workload Attestor (hybrid mode)
219
      WorkloadAttestor "k8s" {
220
        plugin_data {
221
          # Skip kubelet verification for speed
222
          skip_kubelet_verification = false
223

224
          # Kubelet read-only port (if enabled)
225
          kubelet_read_only_port = 10255
226

227
          # Use secure kubelet port
228
          kubelet_secure_port = 10250
229

230
          # Node name override
231
          # node_name_env = "MY_NODE_NAME"
232

233
          # Kubernetes configuration
234
          kube_config_file = "/run/spire/k8s/kubeconfig"
235
        }
236
      }
237

238
      KeyManager "memory" {
239
        plugin_data = {}
240
      }
241
    }
242

243
    health_checks {
244
      listener_enabled = true
245
      bind_address = "0.0.0.0"
246
      bind_port = "8080"
247
      live_path = "/live"
248
      ready_path = "/ready"
249
    }
250

251
    telemetry {
252
      Prometheus {
253
        bind_address = "0.0.0.0"
254
        bind_port = "9988"
255
      }
256
    }

TPM Deployment with Helm#

Create a Helm values file for TPM-enabled SPIRE:

1
global:
2
  spire:
3
    trustDomain: "enterprise.example.com"
4
    bundleEndpoint:
5
      address: "0.0.0.0"
6
      port: 8443
7

8
spire-server:
9
  replicaCount: 3
10

11
  # TPM-specific configuration
12
  configMap:
13
    server.conf: |
14
      # Include the TPM server config from above
15

16
  # Mount TPM certificates
17
  extraVolumes:
18
    - name: tpm-certs
19
      secret:
20
        secretName: tpm-endorsement-certs
21

22
  extraVolumeMounts:
23
    - name: tpm-certs
24
      mountPath: /etc/spire/certs
25
      readOnly: true
26

27
  # Enhanced security for TPM deployment
28
  securityContext:
29
    runAsNonRoot: true
30
    runAsUser: 1000
31
    fsGroup: 1000
32
    seccompProfile:
33
      type: RuntimeDefault
34

35
  # Resource requirements for TPM verification
36
  resources:
37
    requests:
38
      memory: "1Gi"
39
      cpu: "200m"
40
    limits:
41
      memory: "4Gi"
42
      cpu: "2000m"
43

44
spire-agent:
45
  # Node selection for TPM-enabled nodes
46
  nodeSelector:
47
    hardware.feature.node.kubernetes.io/tpm: "true"
48

49
  # Privileged mode for TPM access
50
  securityContext:
51
    privileged: true
52

53
  # Mount TPM device
54
  extraVolumes:
55
    - name: tpm-device
56
      hostPath:
57
        path: /dev/tpmrm0
58
        type: CharDevice
59

60
  extraVolumeMounts:
61
    - name: tpm-device
62
      mountPath: /dev/tpmrm0
63

64
  # Enhanced resources for TPM operations
65
  resources:
66
    requests:
67
      memory: "256Mi"
68
      cpu: "100m"
69
    limits:
70
      memory: "1Gi"
71
      cpu: "1000m"
72

73
spiffe-csi-driver:
74
  enabled: true
75

76
spiffe-oidc-discovery-provider:
77
  enabled: true
78
  config:
79
    domains:
80
      - "oidc.enterprise.example.com"

Deploy with TPM support:

1
# Label nodes with TPM capability
2
kubectl label nodes worker-node-1 hardware.feature.node.kubernetes.io/tpm=true
3
kubectl label nodes worker-node-2 hardware.feature.node.kubernetes.io/tpm=true
4

5
# Create TPM endorsement certificate secret
6
kubectl create secret generic tpm-endorsement-certs \
7
  --from-file=tpm-ek-cert-1.pem \
8
  --from-file=tpm-ek-cert-2.pem \
9
  -n spire-system
10

11
# Deploy SPIRE with TPM
12
helm upgrade --install spire spiffe/spire \
13
  --namespace spire-system \
14
  --values tpm-values.yaml \
15
  --wait

Cloud Provider Attestation#

Cloud provider attestation leverages platform-specific instance identity documents to verify node identity without requiring shared secrets or certificates.

AWS Instance Identity Document (IID) Attestation#

AWS provides cryptographically signed instance metadata that SPIRE can verify:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-server-aws-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      bind_address = "0.0.0.0"
10
      bind_port = "8081"
11
      trust_domain = "aws.enterprise.example.com"
12
      data_dir = "/run/spire/data"
13
      log_level = "INFO"
14
    }
15

16
    plugins {
17
      # AWS IID Node Attestor
18
      NodeAttestor "aws_iid" {
19
        plugin_data {
20
          # AWS credentials for verification
21
          # Can use IAM roles instead of access keys
22
          access_key_id = "${AWS_ACCESS_KEY_ID}"
23
          secret_access_key = "${AWS_SECRET_ACCESS_KEY}"
24

25
          # Alternative: Use IAM role
26
          # assume_role_arn = "arn:aws:iam::123456789012:role/spire-server-role"
27

28
          # AWS region
29
          region = "us-east-1"
30

31
          # Account ID whitelist
32
          account_ids_for_verification = [
33
            "123456789012",
34
            "234567890123"
35
          ]
36

37
          # Instance tag requirements
38
          # Only instances with these tags can attest
39
          instance_tag_requirements = {
40
            "Environment" = ["production", "staging"]
41
            "Team" = ["platform", "security"]
42
            "SPIREManaged" = ["true"]
43
          }
44

45
          # Allowed regions
46
          allowed_regions = [
47
            "us-east-1",
48
            "us-west-2",
49
            "eu-west-1"
50
          ]
51

52
          # Allowed instance types
53
          allowed_instance_types = [
54
            "t3.medium",
55
            "t3.large",
56
            "m5.large",
57
            "m5.xlarge",
58
            "c5.large"
59
          ]
60

61
          # VPC ID whitelist
62
          allowed_vpc_ids = [
63
            "vpc-12345678",
64
            "vpc-87654321"
65
          ]
66

67
          # Subnet whitelist
68
          allowed_subnet_ids = [
69
            "subnet-12345678",
70
            "subnet-87654321"
71
          ]
72

73
          # Security group requirements
74
          required_security_groups = [
75
            "sg-spire-nodes"
76
          ]
77

78
          # AMI ID whitelist (for golden images)
79
          allowed_ami_ids = [
80
            "ami-0123456789abcdef0",
81
            "ami-0fedcba9876543210"
82
          ]
83

84
          # Skip verification of block device mappings
85
          skip_block_device = false
86

87
          # Local metadata only (don't call AWS APIs)
88
          local_only = false
89

90
          # Disable instance identity document signature verification
91
          # (NOT recommended for production)
92
          disable_instance_profile_selectors = false
93

94
          # Custom CA bundle for AWS API calls
95
          # ca_bundle_path = "/etc/ssl/certs/ca-bundle.pem"
96

97
          # HTTP timeout for AWS API calls
98
          http_timeout = "30s"
99

100
          # Maximum number of retries for AWS API calls
101
          max_retries = 3
102
        }
103
      }
104

105
      # AWS Instance Metadata Workload Attestor
106
      WorkloadAttestor "aws_iid" {
107
        plugin_data {
108
          # Skip verification of instance metadata
109
          skip_verification = false
110

111
          # Use instance metadata v2 (more secure)
112
          use_imdsv2 = true
113

114
          # Custom metadata endpoint
115
          # metadata_endpoint = "http://169.254.169.254"
116

117
          # Timeout for metadata calls
118
          timeout = "10s"
119
        }
120
      }
121

122
      DataStore "sql" {
123
        plugin_data {
124
          database_type = "postgres"
125
          connection_string = "host=postgres-ha.data.svc.cluster.local dbname=spire user=spire sslmode=require"
126
        }
127
      }
128

129
      KeyManager "aws_kms" {
130
        plugin_data {
131
          # KMS key for SPIRE server keys
132
          key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
133

134
          # AWS region
135
          region = "us-east-1"
136

137
          # Key spec
138
          key_spec = "RSA_2048"
139

140
          # Key usage
141
          key_usage = "SIGN_VERIFY"
142

143
          # AWS credentials (or use IAM role)
144
          access_key_id = "${AWS_ACCESS_KEY_ID}"
145
          secret_access_key = "${AWS_SECRET_ACCESS_KEY}"
146
        }
147
      }
148

149
      UpstreamAuthority "aws_pca" {
150
        plugin_data {
151
          # Private CA ARN
152
          certificate_authority_arn = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
153

154
          # AWS region
155
          region = "us-east-1"
156

157
          # Certificate validity period
158
          validity_period_hours = 8760  # 1 year
159

160
          # Certificate template ARN (optional)
161
          # template_arn = "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1"
162

163
          # AWS credentials
164
          access_key_id = "${AWS_ACCESS_KEY_ID}"
165
          secret_access_key = "${AWS_SECRET_ACCESS_KEY}"
166

167
          # Subject alternative names
168
          subject_alternative_names = [
169
            "spire-server.spire-system.svc.cluster.local"
170
          ]
171

172
          # Certificate signing algorithm
173
          signing_algorithm = "SHA256WITHRSA"
174
        }
175
      }
176
    }
177
---
178
# AWS Agent Configuration
179
apiVersion: v1
180
kind: ConfigMap
181
metadata:
182
  name: spire-agent-aws-config
183
  namespace: spire-system
184
data:
185
  agent.conf: |
186
    agent {
187
      data_dir = "/run/spire/data"
188
      log_level = "INFO"
189
      server_address = "spire-server.spire-system"
190
      server_port = "8081"
191
      socket_path = "/run/spire/sockets/agent.sock"
192
      trust_bundle_path = "/run/spire/bundle/bundle.crt"
193
      trust_domain = "aws.enterprise.example.com"
194
    }
195

196
    plugins {
197
      # AWS IID Node Attestor
198
      NodeAttestor "aws_iid" {
199
        plugin_data {
200
          # Use IMDSv2 for better security
201
          use_imdsv2 = true
202

203
          # Metadata endpoint override (if needed)
204
          # ec2_metadata_endpoint = "http://169.254.169.254"
205

206
          # Skip verification (for testing only)
207
          skip_verification = false
208

209
          # Local metadata timeout
210
          timeout = "30s"
211

212
          # Retry configuration
213
          max_retries = 3
214
          retry_delay = "1s"
215
        }
216
      }
217

218
      # Kubernetes Workload Attestor (hybrid)
219
      WorkloadAttestor "k8s" {
220
        plugin_data {
221
          skip_kubelet_verification = false
222
          kubelet_secure_port = 10250
223
        }
224
      }
225

226
      # Docker Workload Attestor (for non-K8s workloads)
227
      WorkloadAttestor "docker" {
228
        plugin_data {
229
          # Docker daemon socket
230
          docker_socket_path = "unix:///var/run/docker.sock"
231

232
          # Container label requirements
233
          container_id_cgroup_matchers = [
234
            "/docker/([^/]+)",
235
            "/system.slice/docker-([^.]+).scope"
236
          ]
237

238
          # Reuse connections
239
          use_new_container_locator = true
240
        }
241
      }
242

243
      KeyManager "memory" {
244
        plugin_data = {}
245
      }
246
    }

GCP Instance Identity Token (IIT) Attestation#

Google Cloud Platform provides JWT-based instance identity tokens:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-server-gcp-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      bind_address = "0.0.0.0"
10
      bind_port = "8081"
11
      trust_domain = "gcp.enterprise.example.com"
12
      data_dir = "/run/spire/data"
13
      log_level = "INFO"
14
    }
15

16
    plugins {
17
      # GCP IIT Node Attestor
18
      NodeAttestor "gcp_iit" {
19
        plugin_data {
20
          # GCP Project ID whitelist
21
          projectid_whitelist = [
22
            "my-project-prod",
23
            "my-project-staging",
24
            "shared-services"
25
          ]
26

27
          # Service account whitelist
28
          service_account_whitelist = [
29
            "spire-agent@my-project-prod.iam.gserviceaccount.com",
30
            "k8s-nodes@my-project-prod.iam.gserviceaccount.com"
31
          ]
32

33
          # Zone whitelist
34
          zone_whitelist = [
35
            "us-central1-a",
36
            "us-central1-b",
37
            "us-central1-c",
38
            "us-east1-a"
39
          ]
40

41
          # Instance label requirements
42
          instance_label_whitelist = {
43
            "environment" = ["prod", "staging"]
44
            "team" = ["platform"]
45
            "spire-managed" = ["true"]
46
          }
47

48
          # Machine type whitelist
49
          machine_type_whitelist = [
50
            "n1-standard-2",
51
            "n1-standard-4",
52
            "e2-standard-2",
53
            "e2-standard-4"
54
          ]
55

56
          # Network whitelist
57
          network_whitelist = [
58
            "projects/my-project-prod/global/networks/vpc-prod",
59
            "projects/my-project-staging/global/networks/vpc-staging"
60
          ]
61

62
          # Subnetwork whitelist
63
          subnetwork_whitelist = [
64
            "projects/my-project-prod/regions/us-central1/subnetworks/subnet-k8s",
65
            "projects/my-project-prod/regions/us-east1/subnetworks/subnet-k8s"
66
          ]
67

68
          # Custom audience for token verification
69
          # audience = "spire://gcp.enterprise.example.com"
70

71
          # Token lifetime
72
          token_lifetime = "3600s"
73

74
          # Google Cloud credentials
75
          # If not specified, uses Application Default Credentials
76
          # credentials_file = "/var/secrets/google/key.json"
77

78
          # Custom CA bundle for Google APIs
79
          # ca_bundle_path = "/etc/ssl/certs/ca-bundle.pem"
80

81
          # HTTP timeout
82
          http_timeout = "30s"
83

84
          # Maximum retries
85
          max_retries = 3
86
        }
87
      }
88

89
      DataStore "sql" {
90
        plugin_data {
91
          database_type = "postgres"
92
          connection_string = "host=postgres-ha.data.svc.cluster.local dbname=spire user=spire sslmode=require"
93
        }
94
      }
95

96
      KeyManager "gcp_kms" {
97
        plugin_data {
98
          # Cloud KMS key
99
          key_name = "projects/my-project-prod/locations/us-central1/keyRings/spire/cryptoKeys/spire-server"
100

101
          # Key version (optional, uses latest if not specified)
102
          # key_version = "1"
103

104
          # Google Cloud credentials
105
          # credentials_file = "/var/secrets/google/key.json"
106

107
          # HTTP timeout
108
          http_timeout = "30s"
109
        }
110
      }
111

112
      UpstreamAuthority "gcp_cas" {
113
        plugin_data {
114
          # Certificate Authority Service CA
115
          ca_name = "projects/my-project-prod/locations/us-central1/certificateAuthorities/spire-ca"
116

117
          # Certificate validity
118
          validity_period_hours = 8760  # 1 year
119

120
          # Certificate template (optional)
121
          # certificate_template = "projects/my-project-prod/locations/us-central1/certificateTemplates/spire-template"
122

123
          # Google Cloud credentials
124
          # credentials_file = "/var/secrets/google/key.json"
125

126
          # Subject alternative names
127
          subject_alternative_names = [
128
            "spire-server.spire-system.svc.cluster.local"
129
          ]
130
        }
131
      }
132
    }
133
---
134
# GCP Agent Configuration
135
apiVersion: v1
136
kind: ConfigMap
137
metadata:
138
  name: spire-agent-gcp-config
139
  namespace: spire-system
140
data:
141
  agent.conf: |
142
    agent {
143
      data_dir = "/run/spire/data"
144
      log_level = "INFO"
145
      server_address = "spire-server.spire-system"
146
      server_port = "8081"
147
      socket_path = "/run/spire/sockets/agent.sock"
148
      trust_bundle_path = "/run/spire/bundle/bundle.crt"
149
      trust_domain = "gcp.enterprise.example.com"
150
    }
151

152
    plugins {
153
      # GCP IIT Node Attestor
154
      NodeAttestor "gcp_iit" {
155
        plugin_data {
156
          # Custom audience for token
157
          # audience = "spire://gcp.enterprise.example.com"
158

159
          # Service account email override
160
          # service_account_email = "spire-agent@my-project-prod.iam.gserviceaccount.com"
161

162
          # Token format (access_token or id_token)
163
          token_type = "id_token"
164

165
          # Custom metadata endpoint
166
          # metadata_endpoint = "http://metadata.google.internal"
167

168
          # Request timeout
169
          timeout = "30s"
170
        }
171
      }
172

173
      # Kubernetes Workload Attestor
174
      WorkloadAttestor "k8s" {
175
        plugin_data {
176
          skip_kubelet_verification = false
177
          kubelet_secure_port = 10250
178
        }
179
      }
180

181
      KeyManager "memory" {
182
        plugin_data = {}
183
      }
184
    }

Azure Managed Service Identity (MSI) Attestation#

Azure provides Managed Service Identity tokens for attestation:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-server-azure-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      bind_address = "0.0.0.0"
10
      bind_port = "8081"
11
      trust_domain = "azure.enterprise.example.com"
12
      data_dir = "/run/spire/data"
13
      log_level = "INFO"
14
    }
15

16
    plugins {
17
      # Azure MSI Node Attestor
18
      NodeAttestor "azure_msi" {
19
        plugin_data {
20
          # Azure tenant ID
21
          tenant_id = "12345678-1234-1234-1234-123456789012"
22

23
          # Subscription ID whitelist
24
          subscription_ids = [
25
            "12345678-1234-1234-1234-123456789012",
26
            "87654321-4321-4321-4321-210987654321"
27
          ]
28

29
          # Resource group whitelist
30
          resource_groups = [
31
            "rg-spire-prod",
32
            "rg-spire-staging",
33
            "rg-shared-services"
34
          ]
35

36
          # VM resource name patterns
37
          vm_name_patterns = [
38
            "spire-agent-*",
39
            "k8s-node-*"
40
          ]
41

42
          # Network security group requirements
43
          required_nsg_names = [
44
            "nsg-spire-nodes"
45
          ]
46

47
          # Virtual network whitelist
48
          vnet_names = [
49
            "vnet-prod",
50
            "vnet-staging"
51
          ]
52

53
          # Subnet whitelist
54
          subnet_names = [
55
            "subnet-k8s-prod",
56
            "subnet-k8s-staging"
57
          ]
58

59
          # VM size whitelist
60
          vm_sizes = [
61
            "Standard_D2s_v3",
62
            "Standard_D4s_v3",
63
            "Standard_B2s",
64
            "Standard_B4ms"
65
          ]
66

67
          # Location whitelist
68
          locations = [
69
            "East US",
70
            "West US 2",
71
            "Central US"
72
          ]
73

74
          # Custom audience for MSI token
75
          # audience = "spire://azure.enterprise.example.com"
76

77
          # Azure credentials for API verification
78
          # If not specified, uses Managed Identity
79
          # client_id = "12345678-1234-1234-1234-123456789012"
80
          # client_secret = "${AZURE_CLIENT_SECRET}"
81

82
          # Azure cloud environment
83
          # azure_environment = "AzurePublicCloud"  # or AzureGovernmentCloud, etc.
84

85
          # HTTP timeout
86
          http_timeout = "30s"
87

88
          # Maximum retries
89
          max_retries = 3
90
        }
91
      }
92

93
      DataStore "sql" {
94
        plugin_data {
95
          database_type = "postgres"
96
          connection_string = "host=postgres-ha.data.svc.cluster.local dbname=spire user=spire sslmode=require"
97
        }
98
      }
99

100
      KeyManager "azure_kv" {
101
        plugin_data {
102
          # Azure Key Vault URL
103
          vault_uri = "https://spire-kv-prod.vault.azure.net/"
104

105
          # Key name in Key Vault
106
          key_name = "spire-server-key"
107

108
          # Key type and size
109
          key_type = "RSA"
110
          key_size = 2048
111

112
          # Azure credentials
113
          # Use Managed Identity if available
114
          # client_id = "12345678-1234-1234-1234-123456789012"
115
          # client_secret = "${AZURE_CLIENT_SECRET}"
116
          tenant_id = "12345678-1234-1234-1234-123456789012"
117

118
          # HTTP timeout
119
          http_timeout = "30s"
120
        }
121
      }
122

123
      UpstreamAuthority "azure_kv" {
124
        plugin_data {
125
          # Certificate in Key Vault
126
          vault_uri = "https://spire-kv-prod.vault.azure.net/"
127
          cert_name = "spire-ca-cert"
128
          key_name = "spire-ca-key"
129

130
          # Certificate validity
131
          validity_period_hours = 8760
132

133
          # Azure credentials
134
          tenant_id = "12345678-1234-1234-1234-123456789012"
135

136
          # Subject alternative names
137
          subject_alternative_names = [
138
            "spire-server.spire-system.svc.cluster.local"
139
          ]
140
        }
141
      }
142
    }
143
---
144
# Azure Agent Configuration
145
apiVersion: v1
146
kind: ConfigMap
147
metadata:
148
  name: spire-agent-azure-config
149
  namespace: spire-system
150
data:
151
  agent.conf: |
152
    agent {
153
      data_dir = "/run/spire/data"
154
      log_level = "INFO"
155
      server_address = "spire-server.spire-system"
156
      server_port = "8081"
157
      socket_path = "/run/spire/sockets/agent.sock"
158
      trust_bundle_path = "/run/spire/bundle/bundle.crt"
159
      trust_domain = "azure.enterprise.example.com"
160
    }
161

162
    plugins {
163
      # Azure MSI Node Attestor
164
      NodeAttestor "azure_msi" {
165
        plugin_data {
166
          # Tenant ID
167
          tenant_id = "12345678-1234-1234-1234-123456789012"
168

169
          # Custom audience
170
          # audience = "spire://azure.enterprise.example.com"
171

172
          # Use system-assigned identity
173
          use_system_assigned_identity = true
174

175
          # Or use user-assigned identity
176
          # user_assigned_identity_client_id = "12345678-1234-1234-1234-123456789012"
177

178
          # Custom metadata endpoint
179
          # metadata_endpoint = "http://169.254.169.254"
180

181
          # Request timeout
182
          timeout = "30s"
183
        }
184
      }
185

186
      # Kubernetes Workload Attestor
187
      WorkloadAttestor "k8s" {
188
        plugin_data {
189
          skip_kubelet_verification = false
190
          kubelet_secure_port = 10250
191
        }
192
      }
193

194
      KeyManager "memory" {
195
        plugin_data = {}
196
      }
197
    }

Hybrid Multi-Factor Attestation#

For maximum security, combine multiple attestation methods:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-server-hybrid-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      bind_address = "0.0.0.0"
10
      bind_port = "8081"
11
      trust_domain = "hybrid.enterprise.example.com"
12
      data_dir = "/run/spire/data"
13
      log_level = "INFO"
14

15
      # Require multiple attestation factors
16
      experimental {
17
        # Multi-attestor support
18
        multi_attestor = true
19

20
        # Minimum number of successful attestors required
21
        min_attestor_count = 2
22

23
        # Required attestor combinations
24
        required_attestor_combinations = [
25
          ["tpm", "aws_iid"],           # TPM + AWS
26
          ["tpm", "k8s_psat"],          # TPM + Kubernetes
27
          ["aws_iid", "k8s_psat"],      # AWS + Kubernetes
28
          ["gcp_iit", "k8s_psat"]       # GCP + Kubernetes
29
        ]
30
      }
31
    }
32

33
    plugins {
34
      # Primary: TPM Attestor (strongest)
35
      NodeAttestor "tpm" {
36
        plugin_data {
37
          tpm_path = "/dev/tpmrm0"
38
          hash_algorithm = "sha256"
39
          pcr_selections {
40
            hash_alg = "sha256"
41
            pcr_ids = [0, 1, 2, 7]
42
          }
43
          require_secure_boot = true
44
        }
45
      }
46

47
      # Secondary: AWS IID Attestor
48
      NodeAttestor "aws_iid" {
49
        plugin_data {
50
          access_key_id = "${AWS_ACCESS_KEY_ID}"
51
          secret_access_key = "${AWS_SECRET_ACCESS_KEY}"
52
          account_ids_for_verification = ["123456789012"]
53
          instance_tag_requirements = {
54
            "Environment" = ["production"]
55
            "TPMEnabled" = ["true"]
56
          }
57
        }
58
      }
59

60
      # Tertiary: Kubernetes PSAT Attestor
61
      NodeAttestor "k8s_psat" {
62
        plugin_data {
63
          service_account_allow_list = ["spire-agent"]
64
          audience = ["spire-server"]
65
          cluster = "production-cluster"
66
        }
67
      }
68

69
      # Workload attestation with multiple factors
70
      WorkloadAttestor "tpm" {
71
        plugin_data {
72
          tpm_path = "/dev/tpmrm0"
73
          workload_pcr = 23
74
          measurement_policy {
75
            required_measurements = [
76
              "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
77
            ]
78
          }
79
        }
80
      }
81

82
      WorkloadAttestor "k8s" {
83
        plugin_data {
84
          skip_kubelet_verification = false
85
          kubelet_secure_port = 10250
86
        }
87
      }
88

89
      WorkloadAttestor "docker" {
90
        plugin_data {
91
          docker_socket_path = "unix:///var/run/docker.sock"
92
        }
93
      }
94

95
      # Multi-cloud key management
96
      KeyManager "aws_kms" {
97
        plugin_data {
98
          key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
99
          region = "us-east-1"
100
        }
101
      }
102

103
      DataStore "sql" {
104
        plugin_data {
105
          database_type = "postgres"
106
          connection_string = "host=postgres-ha.data.svc.cluster.local dbname=spire user=spire sslmode=require"
107
        }
108
      }
109
    }

Advanced Attestation Policies#

Create sophisticated policy enforcement for attestation:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-attestation-policies
5
  namespace: spire-system
6
data:
7
  # OPA policy for node attestation
8
  node-attestation.rego: |
9
    package spire.node_attestation
10

11
    import future.keywords.contains
12
    import future.keywords.if
13

14
    # Default deny
15
    default allow = false
16

17
    # Allow if all required attestors pass
18
    allow {
19
      required_attestors_present
20
      attestation_strength_sufficient
21
      node_meets_requirements
22
    }
23

24
    # Check required attestor combinations
25
    required_attestors_present {
26
      # Must have TPM + Cloud Provider attestation for production
27
      input.attestors.tpm.success == true
28
      count(cloud_attestors_success) > 0
29
    }
30

31
    cloud_attestors_success[attestor] {
32
      input.attestors[attestor].success == true
33
      attestor in ["aws_iid", "gcp_iit", "azure_msi"]
34
    }
35

36
    # Attestation strength requirements
37
    attestation_strength_sufficient {
38
      input.environment == "development"
39
    }
40

41
    attestation_strength_sufficient {
42
      input.environment == "staging"
43
      count(successful_attestors) >= 2
44
    }
45

46
    attestation_strength_sufficient {
47
      input.environment == "production"
48
      count(successful_attestors) >= 3
49
      input.attestors.tpm.secure_boot == true
50
    }
51

52
    successful_attestors[attestor] {
53
      input.attestors[attestor].success == true
54
    }
55

56
    # Node requirements based on environment
57
    node_meets_requirements {
58
      input.environment == "development"
59
    }
60

61
    node_meets_requirements {
62
      input.environment == "staging"
63
      node_properly_tagged
64
      node_in_allowed_network
65
    }
66

67
    node_meets_requirements {
68
      input.environment == "production"
69
      node_properly_tagged
70
      node_in_allowed_network
71
      node_meets_security_requirements
72
    }
73

74
    node_properly_tagged {
75
      input.node.tags.Environment == input.environment
76
      input.node.tags.Team != ""
77
      input.node.tags.SPIREManaged == "true"
78
    }
79

80
    node_in_allowed_network {
81
      input.node.network.vpc_id in ["vpc-12345678", "vpc-87654321"]
82
      input.node.network.subnet_id in allowed_subnets
83
    }
84

85
    allowed_subnets := [
86
      "subnet-12345678",
87
      "subnet-87654321",
88
      "subnet-abcdef01"
89
    ]
90

91
    node_meets_security_requirements {
92
      # Require encrypted storage
93
      input.node.storage.encrypted == true
94

95
      # Require specific instance types
96
      input.node.instance_type in allowed_instance_types
97

98
      # Require recent AMI/image
99
      time.now_ns() - input.node.image.created_time < (30 * 24 * 60 * 60 * 1000000000)  # 30 days
100
    }
101

102
    allowed_instance_types := [
103
      "m5.large",
104
      "m5.xlarge",
105
      "c5.large",
106
      "c5.xlarge"
107
    ]
108

109
  # Workload attestation policy
110
  workload-attestation.rego: |
111
    package spire.workload_attestation
112

113
    import future.keywords.contains
114
    import future.keywords.if
115

116
    default allow = false
117

118
    # Allow based on workload type and environment
119
    allow {
120
      workload_type_permitted
121
      security_requirements_met
122
      resource_limits_appropriate
123
    }
124

125
    workload_type_permitted {
126
      input.workload.type == "database"
127
      input.workload.namespace in ["production", "staging"]
128
      input.workload.service_account == "postgres"
129
    }
130

131
    workload_type_permitted {
132
      input.workload.type == "api"
133
      input.workload.namespace in ["production", "staging", "development"]
134
      input.workload.labels.app != ""
135
    }
136

137
    workload_type_permitted {
138
      input.workload.type == "worker"
139
      input.workload.namespace in ["production", "staging"]
140
      input.workload.labels.component == "worker"
141
    }
142

143
    security_requirements_met {
144
      input.workload.namespace == "development"
145
    }
146

147
    security_requirements_met {
148
      input.workload.namespace in ["staging", "production"]
149
      workload_security_context_valid
150
      workload_properly_labeled
151
      workload_uses_secure_images
152
    }
153

154
    workload_security_context_valid {
155
      input.workload.security_context.run_as_non_root == true
156
      input.workload.security_context.read_only_root_filesystem == true
157
      input.workload.security_context.allow_privilege_escalation == false
158
    }
159

160
    workload_properly_labeled {
161
      input.workload.labels.version != ""
162
      input.workload.labels.environment == input.workload.namespace
163
      input.workload.labels["app.kubernetes.io/managed-by"] == "spire"
164
    }
165

166
    workload_uses_secure_images {
167
      # Require images from trusted registries
168
      startswith(input.workload.image, "enterprise.example.com/")
169

170
      # Require vulnerability scan tags
171
      input.workload.labels["security.scan.status"] == "passed"
172

173
      # Require recent images
174
      time.now_ns() - input.workload.image_created_time < (7 * 24 * 60 * 60 * 1000000000)  # 7 days
175
    }
176

177
    resource_limits_appropriate {
178
      input.workload.resources.limits.memory <= "2Gi"
179
      input.workload.resources.limits.cpu <= "1000m"
180
      input.workload.resources.requests.memory != ""
181
      input.workload.resources.requests.cpu != ""
182
    }

Monitoring and Observability for Advanced Attestation#

Set up comprehensive monitoring for attestation events:

1
apiVersion: monitoring.coreos.com/v1
2
kind: ServiceMonitor
3
metadata:
4
  name: spire-attestation-monitoring
5
  namespace: spire-system
6
spec:
7
  selector:
8
    matchLabels:
9
      app: spire-server
10
  endpoints:
11
    - port: metrics
12
      interval: 30s
13
      path: /metrics
14
      relabelings:
15
        - sourceLabels: [__name__]
16
          regex: "spire_server_node_attestor_.*|spire_server_workload_attestor_.*"
17
          action: keep
18
---
19
# AlertManager rules for attestation failures
20
apiVersion: monitoring.coreos.com/v1
21
kind: PrometheusRule
22
metadata:
23
  name: spire-attestation-alerts
24
  namespace: spire-system
25
spec:
26
  groups:
27
    - name: spire.attestation
28
      rules:
29
        - alert: SPIRENodeAttestationFailure
30
          expr: increase(spire_server_node_attestor_failure_total[5m]) > 0
31
          for: 2m
32
          labels:
33
            severity: warning
34
            component: spire-server
35
          annotations:
36
            summary: "SPIRE node attestation failures detected"
37
            description: "Node attestation failures have been detected for attestor {{ $labels.attestor_type }}"
38

39
        - alert: SPIRETPMAttestationFailure
40
          expr: increase(spire_server_node_attestor_failure_total{attestor_type="tpm"}[5m]) > 0
41
          for: 1m
42
          labels:
43
            severity: critical
44
            component: spire-server
45
          annotations:
46
            summary: "SPIRE TPM attestation failure - critical security event"
47
            description: "TPM attestation failure detected - potential hardware tampering or misconfiguration"
48

49
        - alert: SPIREWorkloadAttestationFailure
50
          expr: increase(spire_server_workload_attestor_failure_total[5m]) > 5
51
          for: 3m
52
          labels:
53
            severity: warning
54
            component: spire-server
55
          annotations:
56
            summary: "High rate of workload attestation failures"
57
            description: "{{ $value }} workload attestation failures in the last 5 minutes"
58

59
        - alert: SPIREAttestationLatencyHigh
60
          expr: histogram_quantile(0.99, rate(spire_server_node_attestor_duration_seconds_bucket[5m])) > 30
61
          for: 5m
62
          labels:
63
            severity: warning
64
            component: spire-server
65
          annotations:
66
            summary: "SPIRE attestation latency is high"
67
            description: "99th percentile attestation latency is {{ $value }}s"
68

69
        - alert: SPIRECloudProviderAttestationDown
70
          expr: up{job="spire-server"} == 0
71
          for: 2m
72
          labels:
73
            severity: critical
74
            component: spire-server
75
          annotations:
76
            summary: "SPIRE server is down - cloud provider attestation unavailable"
77
            description: "SPIRE server has been down for more than 2 minutes"

Performance Optimization for Advanced Attestation#

Configure performance optimizations for resource-intensive attestation:

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-performance-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      # ... other config ...
10

11
      # Performance optimizations for advanced attestation
12
      experimental {
13
        # Cache attestation results
14
        attestation_caching = true
15
        attestation_cache_ttl = "300s"
16
        attestation_cache_size = 10000
17

18
        # Parallel attestation processing
19
        parallel_attestation = true
20
        max_parallel_attestations = 10
21

22
        # TPM optimization
23
        tpm_attestation_cache = true
24
        tpm_cache_ttl = "3600s"
25

26
        # Cloud provider API optimization
27
        cloud_api_cache = true
28
        cloud_api_cache_ttl = "300s"
29
        cloud_api_max_concurrent_requests = 5
30

31
        # Connection pooling for cloud APIs
32
        cloud_api_connection_pool_size = 10
33
        cloud_api_connection_pool_timeout = "30s"
34
      }
35
    }
36

37
    plugins {
38
      # Optimized node attestors
39
      NodeAttestor "tpm" {
40
        plugin_data {
41
          # TPM performance optimizations
42
          cache_quotes = true
43
          quote_cache_ttl = "3600s"
44
          parallel_pcr_reads = true
45
          pcr_read_timeout = "5s"
46

47
          # Batch PCR operations
48
          batch_pcr_operations = true
49
          max_batch_size = 8
50
        }
51
      }
52

53
      NodeAttestor "aws_iid" {
54
        plugin_data {
55
          # AWS API optimizations
56
          connection_pool_size = 10
57
          max_idle_connections = 5
58
          idle_connection_timeout = "90s"
59

60
          # Request optimization
61
          http_timeout = "30s"
62
          max_retries = 3
63
          retry_delay = "1s"
64

65
          # Cache instance metadata
66
          cache_instance_metadata = true
67
          metadata_cache_ttl = "300s"
68
        }
69
      }
70

71
      # Resource limits for heavy operations
72
      DataStore "sql" {
73
        plugin_data {
74
          # Connection pooling
75
          max_open_connections = 25
76
          max_idle_connections = 10
77
          connection_max_lifetime = "5m"
78

79
          # Query optimization
80
          query_timeout = "30s"
81
          slow_query_threshold = "1s"
82
        }
83
      }
84
    }
85
---
86
# Resource configurations for performance
87
apiVersion: v1
88
kind: ConfigMap
89
metadata:
90
  name: spire-resource-config
91
  namespace: spire-system
92
data:
93
  values.yaml: |
94
    spire-server:
95
      # Enhanced resources for advanced attestation
96
      resources:
97
        requests:
98
          memory: "2Gi"
99
          cpu: "500m"
100
        limits:
101
          memory: "8Gi"
102
          cpu: "4000m"
103

104
      # JVM tuning for better performance
105
      extraEnv:
106
        - name: JAVA_OPTS
107
          value: "-Xmx6g -Xms2g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
108

109
      # Node selection for high-performance nodes
110
      nodeSelector:
111
        node-type: "high-memory"
112
        hardware.feature.node.kubernetes.io/tpm: "true"
113

114
      # Anti-affinity for spreading load
115
      affinity:
116
        podAntiAffinity:
117
          preferredDuringSchedulingIgnoredDuringExecution:
118
          - weight: 100
119
            podAffinityTerm:
120
              labelSelector:
121
                matchExpressions:
122
                - key: app
123
                  operator: In
124
                  values:
125
                  - spire-server
126
              topologyKey: kubernetes.io/hostname
127

128
    spire-agent:
129
      # Optimized agent resources
130
      resources:
131
        requests:
132
          memory: "512Mi"
133
          cpu: "200m"
134
        limits:
135
          memory: "2Gi"
136
          cpu: "1000m"
137

138
      # Priority class for critical workloads
139
      priorityClassName: "spire-high-priority"
140

141
      # Enhanced security context for TPM access
142
      securityContext:
143
        privileged: true
144
        allowPrivilegeEscalation: true
145

146
      # Node affinity for TPM-enabled nodes
147
      nodeAffinity:
148
        requiredDuringSchedulingIgnoredDuringExecution:
149
          nodeSelectorTerms:
150
          - matchExpressions:
151
            - key: hardware.feature.node.kubernetes.io/tpm
152
              operator: In
153
              values:
154
              - "true"

Troubleshooting Advanced Attestation#

Common issues and solutions for advanced attestation scenarios:

TPM Attestation Issues#

1
# Check TPM device availability
2
kubectl exec -n spire-system spire-agent-xxxxx -- ls -la /dev/tpm*
3

4
# Verify TPM ownership
5
kubectl exec -n spire-system spire-agent-xxxxx -- tpm2_getcap properties-fixed
6

7
# Check PCR values
8
kubectl exec -n spire-system spire-agent-xxxxx -- tpm2_pcrread sha256
9

10
# Debug TPM attestation
11
kubectl logs -n spire-system spire-agent-xxxxx | grep -i tpm
12

13
# Check TPM attestor status
14
kubectl exec -n spire-system spire-server-0 -c spire-server -- \
15
  /opt/spire/bin/spire-server agent list -attestation-type tpm

Cloud Provider Attestation Issues#

1
# AWS IID troubleshooting
2
kubectl exec -n spire-system spire-agent-xxxxx -- \
3
  curl -s http://169.254.169.254/latest/meta-data/instance-id
4

5
kubectl exec -n spire-system spire-agent-xxxxx -- \
6
  curl -s http://169.254.169.254/latest/dynamic/instance-identity/document
7

8
# GCP IIT troubleshooting
9
kubectl exec -n spire-system spire-agent-xxxxx -- \
10
  curl -s -H "Metadata-Flavor: Google" \
11
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=spire-server
12

13
# Azure MSI troubleshooting
14
kubectl exec -n spire-system spire-agent-xxxxx -- \
15
  curl -s -H "Metadata: true" \
16
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
17

18
# Check attestation logs
19
kubectl logs -n spire-system spire-server-0 -c spire-server | grep -i attestation

Security Considerations and Best Practices#

Defense in Depth#

Multiple Attestation Factors: Always use at least two attestation methods
Hardware Root of Trust: Prefer TPM when available
Cloud Provider Integration: Leverage platform-native security
Regular Rotation: Implement automated key and certificate rotation
Monitoring: Comprehensive logging and alerting for attestation events

Compliance Requirements#

1
# FIPS 140-2 compliance configuration
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: spire-fips-config
6
  namespace: spire-system
7
data:
8
  server.conf: |
9
    server {
10
      # FIPS mode enforcement
11
      experimental {
12
        fips_mode = true
13

14
        # Required cryptographic algorithms
15
        allowed_signing_algorithms = ["RS256", "ES256"]
16
        allowed_hash_algorithms = ["SHA256", "SHA384", "SHA512"]
17

18
        # Minimum key sizes
19
        min_rsa_key_size = 2048
20
        min_ec_key_size = 256
21

22
        # Certificate validation
23
        strict_certificate_validation = true
24
        require_san_validation = true
25

26
        # Audit logging
27
        audit_logging = true
28
        audit_log_path = "/var/log/spire/audit.log"
29
      }
30
    }

Conclusion#

Advanced workload attestation with TPM and cloud providers transforms SPIFFE/SPIRE from a software-based identity system into a hardware-backed, defense-in-depth security platform. By leveraging multiple attestation factors, you can:

✅ Achieve regulatory compliance (FIPS 140-2, Common Criteria)
✅ Implement true zero-trust architecture
✅ Leverage cloud-native security features
✅ Establish hardware root of trust
✅ Create tamper-resistant identity verification

The combination of TPM hardware security, cloud provider attestation, and Kubernetes-native workload verification provides enterprise-grade security suitable for the most demanding environments.

In our next post, we’ll explore service mesh integration patterns, showing how to leverage these advanced attestation capabilities with Istio, Linkerd, and other service mesh platforms for comprehensive zero-trust networking.

Additional Resources#

Questions about implementing advanced attestation in your environment? The SPIFFE community actively supports enterprise deployments and complex attestation scenarios.