Automatic Certificate Rotation
SPIRE's automatic X.509-SVID rotation mechanism that continuously renews workload certificates before they expire, ensuring zero-downtime cryptographic identity refresh (SPIFFE X.509-SVID spec §4.1). The SPIRE Agent proactively monitors SVID lifetimes and triggers renewal at a configurable threshold (typically 50% of lifetime). New SVIDs are delivered to workloads via the streaming Workload API, enabling graceful transition without service interruption. This eliminates the manual certificate management that plagues traditional PKI deployments.
Automatic Certificate Rotation
SPIRE's automatic X.509-SVID rotation mechanism that continuously renews workload certificates before they expire, ensuring zero-downtime cryptographic identity refresh (SPIFFE X.509-SVID spec §4.1). The SPIRE Agent proactively monitors SVID lifetimes and triggers renewal at a configurable threshold (typically 50% of lifetime). New SVIDs are delivered to workloads via the streaming Workload API, enabling graceful transition without service interruption. This eliminates the manual certificate management that plagues traditional PKI deployments.
Sequence Diagram
Click any step for details
Step-by-Step Breakdown
Token Inspector
Specs for this flow
Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.