mTLS solves the authentication problem elegantly — but it immediately creates a massive operational problem.
To have mTLS between 500 microservices running across thousands of pods, every single running instance of every service needs a unique, valid cryptographic certificate. Think of these as digital passports. Now ask yourself:
- How do you generate thousands of certificates automatically as pods spin up and down?
- How do you securely deliver the right certificate to the right workload without a chicken-and-egg problem (the workload needs a certificate to prove its identity, but needs an identity to get a certificate)?
- How do you rotate certificates frequently — ideally every hour — so that a stolen certificate is useless within minutes?
- How do you revoke a certificate immediately if a workload is compromised?
You cannot do any of this manually. A human operator cannot keep pace with a Kubernetes cluster that creates and destroys hundreds of pods per minute.
You need an automated system to act as the Certificate Authority (CA) — the trusted entity that issues, rotates, and revokes the passports. This is the problem that SPIFFE and SPIRE solve.
Why Short-Lived Certificates Matter
Traditional PKI (Public Key Infrastructure) uses certificates that are valid for one or two years. If such a certificate is stolen, an attacker can impersonate that service for up to two years. SPIRE issues certificates valid for as little as one hour. Even if an attacker exfiltrates a certificate from a running pod, it expires before they can meaningfully exploit it. This is the "assume breach" mindset applied to cryptographic identity.