Workload identities are a staple of modern cloud architecture. They are routinely used to authenticate to managed cloud services or fetch secrets from Vault. Yet, when it comes to securing communication between internal services, organizations often default back to static API keys and shared secrets.

Managing these internal credentials is often messy, error-prone, and a massive security risk. There is a better way. In this talk, Thomas will explore how to leverage native Kubernetes features and open standards to eliminate static secrets entirely. He will break down the core mechanics behind OIDC token exchanges, Kubernetes Token Projection, and the SPIFFE/SPIRE ecosystem.

Finally, Thomas will walk through a practical, real-world example: mapping Keycloak identities to Kubernetes service accounts. Attendees will leave with a clear blueprint for enabling seamless, secure, and credentialless service-to-service communication inside their own clusters.