Skip to content

WIMSE Architecture — draft-ietf-wimse-arch#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

Slides Session recording Materials

  • Tier: Core
  • Why: This is the frame every other WIMSE and adjacent OAuth draft below plugs into. An IETF-stream architecture for workload identity means the credential, proof-of-possession, and authentication drafts share one component model instead of each vendor inventing its own — exactly the standardization gap SPIFFE/SPIRE has been filling ad hoc.
  • What: Defines an architecture for standardizing protocols and payloads that convey workload identity and security-context information, where a workload is software executing for a specific purpose, potentially spanning many running instances. (from abstract only)
  • How: Scopes the problem space and the component model (identity, credentials, proof of possession, transport bindings) that the other WIMSE drafts fill in, rather than specifying wire formats itself.
  • Where applicable: General — vendor-neutral by design, applicable to any container-orchestration or multi-service estate. Read this first before the drafts below.