Skip to content

From Bespoke To Bulletproof: SPIFFE/SPIRE With ESO for Enterprise Zero Trust#

KubeCon + CloudNativeCon North America 2025 digest Program Core pick 10–13 November 2025

Recording

Mae Large & Ivy Alkhaz, State Farm — Core

Play the recording: From Bespoke To Bulletproof: SPIFFE/SPIRE With ESO for Enterprise Zero Trust

  • Why: A candid SPIFFE/SPIRE operations talk — what fell over at scale and how an HA topology fixed it — which is more useful than a greenfield demo for anyone running SPIRE in anger.
  • What: The evolution from a hand-rolled SPIFFE/SPIRE deployment that buckled under scale to an HA nested-SPIRE architecture integrated with External Secrets Operator (ESO). (from abstract only)
  • How: Nested SPIRE configured for high availability; SPIFFE SVIDs integrated with ESO's webhook-authenticated SecretStore for secret retrieval and automated rotation; includes debugging detail on ESO webhook 500 errors and scaling SPIRE agents. (from abstract only)
  • Where applicable: Multi-cluster Kubernetes (here on ROSA / OpenShift on AWS) using SPIRE + ESO; the nested-SPIRE HA pattern is general, the ROSA specifics are org-specific.