Core engineering and protocols for SPIFFE/SPIRE Workload Attestation.
Static cloud API tokens and long-lived database passwords are major security liabilities: they are easily leaked in configuration files, committed to source code repositories, or harvested by malware. Modern zero-trust architecture replaces static credentials with dynamic, short-lived workload identities issued via the SPIFFE/SPIRE standard.
AP2Shield enhances SPIRE servers to issue SVID certificates signed with FIPS 204 ML-DSA-65. Containers and Kubernetes pods receive fresh certificates automatically via local UNIX domain sockets, enabling microservices to mutually authenticate and authorize internal RPC traffic without hardcoded secrets.