Authenticating and Authorizing Every Connection at Uber#

Yangmin Zhu & Matt Mathew, Uber — Core

• Why: A multi-year, production-scale SPIFFE/SPIRE zero-trust rollout across thousands of polyglot microservices, with the hard constraint of no application code changes — exactly the workload-identity territory in the PM's wheelhouse, told with operational detail.
• What: The design and three-year rollout of a platform-level service-to-service authn/authz system based on Envoy, SPIRE, and SPIFFE. (from abstract only)
• How: A "Secure Service Mesh" using Envoy as a transparent data plane and SPIRE issuing SPIFFE identities; every connection gets mTLS, workloads are authenticated by SPIFFE ID, and fine-grained policy is enforced through a unified control plane — all without service code changes. (from abstract only)
• Where applicable: Large multi-language, multi-cloud microservice estates. Mechanism is general (Envoy + SPIRE + SPIFFE); the scale and migration sequencing are Uber-specific.