Skip to content

WIT Happens: Exploring the Latest Evolution of the SPIFFE and WIMSE Workload Identity Standards#

KubeCon + CloudNativeCon Europe 2026 digest Program Core pick 23–26 March 2026

Abstract Recording

Noah Stride, Teleport & Arndt Schwenkschuster, Defakto Security

Play the recording: WIT Happens: Exploring the Latest Evolution of the SPIFFE and WIMSE Workload Identity Standards

  • Why: A concrete standards milestone rather than a survey: the IETF WIMSE Working Group's Workload Identity Token is being adopted natively by SPIFFE and SPIRE in 2026. If you have a workload identity strategy, this changes the credential menu.
  • What: What WIT is and how it differs from the credential types SPIFFE already issues, with SPIFFE/WIMSE context for how the two efforts fit together.
  • How: A recap of the existing JWT and X.509 SVID types, then WIT's structure, security properties and presentation methods, compared directly against both. The abstract hedges on a demo of workload-to-workload authentication with WIT ("with any luck"), so treat that as unconfirmed.
  • Where applicable: Anyone running SPIRE or planning workload identity. Standards-track work, so vendor-neutral, but adoption timing is the open question.