Workload Identity
Give every workload an identity, with no stored secrets.
Workloads authenticate with short-lived, attestation-rooted SPIFFE identities instead of stored secrets. MonoCloud trusts your SPIRE authority and issues certificate-bound tokens, extending zero-trust from the cluster to every API.
SPIRE attests it and issues an SVID
spiffe://acme.io/billing
MonoCloud issues a tokenBound to that SVID’s certificate
cnf · x5t#S256Internal or external, over mTLS
billingcopied tokenNo secret is stored at any step
Attestation, not secrets
A secret baked into a pod is a secret waiting to leak.
Long-lived API keys and secrets get copied, logged, and left behind. SPIFFE replaces them with proven identity: each workload gets a short-lived, auto-rotating SVID, so there is nothing static to steal.
Credential
STRIPE_KEY=sk_live_9a••••4f2a- Copied to 3 CI pipelines
- Printed in application logs
- Left in an old container image
How it works
How workload identity works on MonoCloud.
- 1
SPIRE issues an SVID
Attests node and workload. Rotates automatically.
- 2
Workload connects
mTLS to MonoCloud, using its SVID.
- 3
MonoCloud issues a token
Checks trust bundle and policy, binds token to SVID.
- 4
Workload calls the API
Over mTLS, with the bound token.
- 5
API verifies the match
A copied token fails anywhere else.
Powered by SPIRE
- Agent per node
- ~1h rotation
- Cluster CA
Attestation-rooted identity
Identity that is issued, rotated, and revoked automatically.
SPIRE attests each node and workload, then issues a spiffe:// X.509 SVID. Stored API keys disappear from the cluster.
- Pre-shared secrets
- None
- SVID lifetime
- ~1 hour, auto-rotated
- Stolen token
- Useless, bound to the SVID
Your trust authority
Register your SPIRE trust bundle like any other CA.
MonoCloud trusts your SPIRE authority by registering its trust bundle in the truststore, the same way it trusts any online or offline CA.
MonoCloud issues every tokenOne authority across clustersX.509 · offlineRegister in truststoreTrustedspiffe://acme.ioRegister in truststoreTrustedZero-trust past the mesh
The same workload identity,
from the pod to every external API.
MonoCloud is an OAuth 2.0 mTLS authority (RFC 8705). It binds each token to the workload’s SVID, so it works for internal and partner APIs alike and is useless without that SVID.
Control what each workload reaches
Decide which APIs each workload may call.
Per-workload permit and forbid rules decide which APIs each workload can reach, and every issuance lands in one central audit of non-human access.
- Rules checkedPermit or forbid
- Token issuedOnly if permitted
- LoggedOne central audit
permitforbidEvery issuance logged
Fit
When to use workload identity.
If your workloads run on Kubernetes or a service mesh and still hold secrets to call APIs, these are the setups it fits best.
Kubernetes and service-mesh estates adopting SPIFFE as the workload identity standard.
Eliminating long-lived API keys, client secrets, and credentials from clusters.
Workloads that must call APIs beyond the mesh with strong, verifiable identity.
Multi-cluster and hybrid estates needing one token authority across environments.
Zero-trust programs extending past the cluster boundary to every API.
Connects to agents
The identity model that scales your agent fleet.
An agent is a cloud workload. The same SPIFFE model gives every agent, from five to five thousand, its own identity with nothing hardcoded, and you cut one off by banning its SVID.
spiffe://acme.io/agent/research-0001ActiveBannedspiffe://acme.io/agent/research-0412ActiveBannedspiffe://acme.io/agent/support-0087ActiveBannedReplace stored secrets with identity you can prove, rotate, and revoke.
Book a demo, or start free today.