spiffe

The SPIFFE Project

Open source platform for X.509 certificate based service authentication and fine grained access control in dynamic infrastructures. Athenz supports provisioning and configuration (centralized authorization) use cases as well as serving/runtime (decentralized authorization) use cases.

Highflame ZeroID: Autonomous Agent Identity Management System (AAIMS)

The secure gateway connecting AI agents to enterprise systems.

SPIKE is a lightweight secrets store that uses SPIFFE as its identity control plane. It protects your secrets and helps your ops, SREs, and sysadmins manage sensitive data securely with minimal overhead.

VMware Secrets Manager is a lightweight secrets manager to protect your sensitive data. It’s perfect for edge deployments where energy and footprint requirements are strict—See more: https://vsecm.com/

Integrates Spiffe and Vault to have secretless authentication

Tokenex is a Go library that securely exchanges identity tokens for temporary cloud credentials, with built-in support for AWS, GCP, Azure, OCI, Kubernetes, and OAuth2.

Provides agent and server plugins for SPIRE to allow TPM 2-based node attestation.

HTTP/3-enable existing HTTP apps. Leverage HTTP3 native features and auto-enable workload identity (SPIFFE), AuthN (mTLS/x509, OIDC/Auth0-Okta), AuthZ (OPA), defense-in-depth (WAAP/WAF), and observability (metrics, logs, alerting, dashboard).

Capability delegation and authorization for AI agents: scoped, attenuable tokens bound to SPIFFE workload identity and verified fully offline. Go, SPIRE, gRPC, MCP.

OPA-Envoy-SPIRE External Authorization Example.

A collection of crates for SPIFFE workload identity, Workload API clients, SPIRE-specific APIs, and TLS integration.

vault-auth-spire is an authentication plugin for Hashicorp Vault which allows logging into Vault using a Spire provided SVID.

Tutorials about Cilium and SPIRE integration

Runtime security platform for LLM agent tool calls on Kubernetes

SPIFFE based Kafka authentication

SPIFFE Federation the easy way

ROOF (Region Ownership Over Fabric): a multi-node filesystem for fabric-attached memory, with cross-node identity and access control

Multi-Agent Coding Harness with pluggable AI-SDLC: switch sessions across claude, codex, gemini, export/share coding sessions, save tokens, multi-frontend (TUI · web · Telegram).