SPIFFE¶

Secure the backend connection with SPIFFE.

SPIFFE (Secure Production Identity Framework For Everyone), provides a secure identity in the form of a specially crafted X.509 certificate, to every workload in an environment.

Traefik is able to connect to the Workload API to obtain an X509-SVID used to secure the connection with SPIFFE enabled backends.

SPIFFE can cause Traefik to stall

When using SPIFFE, Traefik will wait for the first SVID to be delivered before starting. If Traefik is hanging when waiting on SPIFFE SVID delivery, please double check that it is correctly registered as workload in your SPIFFE infrastructure.

Workload API¶

To enable SPIFFE globally, you need to set up the static configuration. The workloadAPIAddr option specifies the address of the SPIFFE Workload API.

File (YAML)

## Static configuration.
spiffe:
    workloadAPIAddr: localhost

File (TOML)

## Static configuration
[spiffe]
    workloadAPIAddr: localhost

CLI

## Static configuration.
--spiffe.workloadAPIAddr=localhost

ServersTransport¶

Enabling SPIFFE does not imply that backend connections are going to use it automatically. Each ServersTransport or TCPServersTransport, that is meant to be secured with SPIFFE, must explicitly enable it (see SPIFFE with ServersTransport or SPIFFE with TCPServersTransport).

Configuration Example¶

File (YAML)

serversTransport:
  spiffe:
    ids:
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"

File (TOML)

[serversTransport.spiffe]
ids = [ "spiffe://trust-domain/id1", "spiffe://trust-domain/id2" ]
trustDomain = "spiffe://trust-domain"

Kubernetes

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
    spiffe:
      ids:
        - spiffe://trust-domain/id1
        - spiffe://trust-domain/id2