--- title: How to Implement Zero-Trust Workload Identity in... description: IP addresses are not workload identities in Kubernetes — pods get new IPs on every reschedule, silently breaking IP-based network policies. The solution is... canonical: https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Implement Zero-Trust Workload Identity in Kubernetes with SPIFFE, SPIRE, and Cilium | daily.dev og:description: IP addresses are not workload identities in Kubernetes — pods get new IPs on every reschedule, silently breaking IP-based network policies. The solution is... og:url: https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb og:image: https://api.daily.dev/og/posts/8lgSSuAqb.png og:image:alt: How to Implement Zero-Trust Workload Identity in Kubernetes with SPIFFE, SPIRE, and Cilium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Implement Zero-Trust Workload Identity in Kubernetes with SPIFFE, SPIRE, and Cilium **[freeCodeCamp](https://daily.dev/sources/freecodecamp)** · 21 min read · 2 upvotes · 0 comments ## Summary IP addresses are not workload identities in Kubernetes — pods get new IPs on every reschedule, silently breaking IP-based network policies. The solution is cryptographic workload identity via SPIFFE/SPIRE, where each workload receives a short-lived X.509 certificate (SVID) tied to its Kubernetes namespace and service account. Cilium enforces mutual TLS between services using these SVIDs at the eBPF layer, with no sidecars or application code changes required. The guide walks through creating a kind cluster with Cilium as the CNI, deploying SPIRE via a single Helm command, applying a CiliumNetworkPolicy with `authentication.mode: required`, verifying authenticated traffic flows, and confirming unauthorized pods are silently dropped. Hubble observability is also covered for visualizing policy verdicts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Understanding Kubernetes Microsegmentation](https://daily.dev/posts/understanding-kubernetes-microsegmentation-yfwknnvex) · cilium · 0 upvotes · 0 comments - [TEE-backed zero trust: Integrating SPIRE with confidential containers](https://daily.dev/posts/tee-backed-zero-trust-integrating-spire-with-confidential-containers-luit92ipq) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Implement Zero-Trust Workload Identity in Kubernetes with SPIFFE, SPIRE, and Cilium","url":"https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb"},"datePublished":"2026-07-08T00:13:57.500Z","dateModified":"2026-07-08T00:14:20.473Z","description":"IP addresses are not workload identities in Kubernetes — pods get new IPs on every reschedule, silently breaking IP-based network policies. The solution is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b8065a5748f33b0821e709bc2acd6e3b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b8065a5748f33b0821e709bc2acd6e3b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"freeCodeCamp","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"freeCodeCamp","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1628412854/logos/freecodecamp","url":"https://daily.dev/sources/freecodecamp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-implement-zero-trust-workload-identity-in-kubernetes-with-spiffe-spire-and-cilium-8lgssuaqb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,cilium","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"freeCodeCamp","item":"https://daily.dev/sources/freecodecamp"},{"@type":"ListItem","position":3,"name":"How to Implement Zero-Trust Workload Identity in Kubernetes with SPIFFE, SPIRE, and Cilium"}]} ```