--- title: How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust... description: A follow-up architecture guide explains how to extend SPIFFE-based zero trust identity from Kubernetes clusters to off-cluster workloads like VMs and edge... canonical: https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs | daily.dev og:description: A follow-up architecture guide explains how to extend SPIFFE-based zero trust identity from Kubernetes clusters to off-cluster workloads like VMs and edge... og:url: https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4 og:image: https://api.daily.dev/og/posts/LnvC5vNc4.png og:image:alt: How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary A follow-up architecture guide explains how to extend SPIFFE-based zero trust identity from Kubernetes clusters to off-cluster workloads like VMs and edge gateways, without distributing long-lived certificates. It separates identity issuance (handled by Teleport as a trust anchor) from identity consumption (via Envoy and SDS pulling short-lived SVIDs over a local socket), avoiding the secret sprawl and rotation risks of copying certs onto VMs. The post contrasts this with Istio's built-in CA, which locks the trust anchor inside a single cluster, and shows an example Istio AuthorizationPolicy enforcing access based on a VM's SPIFFE identity rather than IP address. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can a VM securely call an Istio service without copying certificate files onto the VM? Instead of copying certificates, the VM runs tbot to join Teleport and expose a local SPIFFE Workload API endpoint, while Envoy retrieves the short-lived SVID and trust bundle via SDS (Secret Discovery Service) over a local socket. Teleport acts as the trust anchor issuing SPIFFE SVIDs, and Istio enforces mTLS and AuthorizationPolicy in-cluster based on the presented SPIFFE identity, eliminating credentials on disk and manual rotation. _Developers building zero trust VM-to-mesh connectivity can track SPIFFE and service mesh approaches on daily.dev._ ### Why is Istio's built-in Certificate Authority limiting for workloads outside the Kubernetes cluster? Istio's internal CA keeps the trust anchor and issuance system inside a single cluster's control plane, forcing off-cluster workloads to bootstrap trust in a cluster-local CA. This makes cluster upgrades, re-installs, or DestinationRule events risky for external callers, and each cluster becomes an isolated identity domain requiring extra federation work to standardize identity across resources. _Teams comparing service mesh trust models can follow zero trust architecture debates on daily.dev._ ## Similar posts on daily.dev - [Zero trust observability: Integrating OpenTelemetry with workload identity manager](https://daily.dev/posts/zero-trust-observability-integrating-opentelemetry-with-workload-identity-manager-vk50fxrme) · Red Hat Developer · 0 upvotes · 0 comments - [How to Implement Zero-Trust Workload Identity in Kubernetes with SPIFFE, SPIRE, and Cilium](https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb) · freeCodeCamp · 2 upvotes · 0 comments - [TEE-backed zero trust: Integrating SPIRE with confidential containers](https://daily.dev/posts/tee-backed-zero-trust-integrating-spire-with-confidential-containers-luit92ipq) · Red Hat Developer · 0 upvotes · 0 comments - [How open standards enable zero trust on commodity hardware](https://daily.dev/posts/how-open-standards-enable-zero-trust-on-commodity-hardware-u0joaw6pb) · The New Stack · 0 upvotes · 0 comments - [Trust Beyond Containers: Identity and Agent Security Lessons from KubeCon 2025](https://daily.dev/posts/trust-beyond-containers-identity-and-agent-security-lessons-from-kubecon-2025-zkkfv36dx) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#istio](https://daily.dev/tags/istio) [View this post on daily.dev](https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs","url":"https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4"},"datePublished":"2026-08-23T12:21:53.461Z","dateModified":"2026-08-23T12:46:22.423Z","description":"A follow-up architecture guide explains how to extend SPIFFE-based zero trust identity from Kubernetes clusters to off-cluster workloads like VMs and edge...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,istio","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-extend-spiffe-beyond-kubernetes-bring-zero-trust-identity-to-your-vms-lnvc5vnc4#faq","mainEntity":[{"@type":"Question","name":"How can a VM securely call an Istio service without copying certificate files onto the VM?","acceptedAnswer":{"@type":"Answer","text":"Instead of copying certificates, the VM runs tbot to join Teleport and expose a local SPIFFE Workload API endpoint, while Envoy retrieves the short-lived SVID and trust bundle via SDS (Secret Discovery Service) over a local socket. Teleport acts as the trust anchor issuing SPIFFE SVIDs, and Istio enforces mTLS and AuthorizationPolicy in-cluster based on the presented SPIFFE identity, eliminating credentials on disk and manual rotation. Developers building zero trust VM-to-mesh connectivity can track SPIFFE and service mesh approaches on daily.dev."}},{"@type":"Question","name":"Why is Istio's built-in Certificate Authority limiting for workloads outside the Kubernetes cluster?","acceptedAnswer":{"@type":"Answer","text":"Istio's internal CA keeps the trust anchor and issuance system inside a single cluster's control plane, forcing off-cluster workloads to bootstrap trust in a cluster-local CA. This makes cluster upgrades, re-installs, or DestinationRule events risky for external callers, and each cluster becomes an isolated identity domain requiring extra federation work to standardize identity across resources. Teams comparing service mesh trust models can follow zero trust architecture debates on daily.dev."}}]} ```