{
  "docVersion": 1,
  "id": "blog-spire-0001",
  "name": "Workload identity — mTLS with SPIRE",
  "purpose": "SPIRE attests nodes and workloads, issues short-lived X.509 SVIDs, and two services verify each other mutually — identity without secrets.",
  "nodes": {
    "spire": {
      "type": "cert",
      "label": "SPIRE Server",
      "x": 400,
      "y": 10,
      "w": 190,
      "runtime": "trust domain: prod.corp"
    },
    "agent1": {
      "type": "worker",
      "label": "SPIRE Agent",
      "x": 130,
      "y": 230,
      "runtime": "node attestation"
    },
    "agent2": {
      "type": "worker",
      "label": "SPIRE Agent",
      "x": 690,
      "y": 230,
      "runtime": "node attestation"
    },
    "svcA": {
      "type": "k8s",
      "label": "Orders API",
      "x": 130,
      "y": 450,
      "runtime": "spiffe://prod/orders",
      "color": "green"
    },
    "svcB": {
      "type": "k8s",
      "label": "Payments API",
      "x": 690,
      "y": 450,
      "runtime": "spiffe://prod/payments",
      "color": "green"
    }
  },
  "edges": {
    "e1": {
      "from": "agent1",
      "to": "spire",
      "fromSide": "top",
      "toSide": "left",
      "label": "attest node · fetch SVIDs",
      "dir": "both"
    },
    "e2": {
      "from": "agent2",
      "to": "spire",
      "fromSide": "top",
      "toSide": "right",
      "label": "attest node · fetch SVIDs",
      "dir": "both"
    },
    "e3": {
      "from": "agent1",
      "to": "svcA",
      "fromSide": "bottom",
      "toSide": "top",
      "label": "Workload API: X.509 SVID"
    },
    "e4": {
      "from": "agent2",
      "to": "svcB",
      "fromSide": "bottom",
      "toSide": "top",
      "label": "Workload API: X.509 SVID"
    },
    "e5": {
      "from": "svcA",
      "to": "svcB",
      "fromSide": "right",
      "toSide": "left",
      "label": "mTLS — both sides verify",
      "dir": "both",
      "color": "green",
      "patterns": [
        "encrypted",
        "authenticated"
      ]
    }
  },
  "boxes": {
    "b1": {
      "x": 60,
      "y": 180,
      "w": 360,
      "h": 440,
      "label": "node 1",
      "color": "gray",
      "opacity": 0.04
    },
    "b2": {
      "x": 620,
      "y": 180,
      "w": 360,
      "h": 440,
      "label": "node 2",
      "color": "gray",
      "opacity": 0.04
    }
  },
  "texts": {
    "t1": {
      "x": 330,
      "y": 610,
      "text": "identity is spiffe://prod/orders — not an IP,\nnot an API key. SVIDs rotate in minutes;\nthere is no secret to leak.",
      "color": "green",
      "size": 12
    }
  },
  "meta": {
    "createdAt": "2026-07-12T09:00:00.000Z",
    "modifiedAt": "2026-07-12T09:00:00.000Z"
  }
}