SPIFFE/SPIRE

SPIRE (the SPIFFE Runtime Environment) is an open-source toolchain and implementation of the SPIFFE workload-identity framework, maintained by the SPIFFE community and hosted as a graduated Cloud Native Computing Foundation project. It exposes the SPIFFE Workload API to attest running software, assign SPIFFE IDs, and issue SPIFFE Verifiable Identity Documents (SVIDs), allowing workloads to establish trust through mTLS or JWT signing and verification and to authenticate securely to services such as secret stores, databases, and cloud providers. SPIRE distributes SPIRE Server and SPIRE Agent binaries, with container images also available for those components and its OIDC discovery provider. Its extensible plugin framework supports different hosting environments and integrations, including an Envoy Secret Discovery Service implementation for installing and rotating TLS certificates and trust bundles. The project provides quickstarts for Kubernetes, Linux, and macOS, along with Go and Java client libraries and example repositories.

SPIFFE (Secure Production Identity Framework for Everyone) is an open framework and set of standards for assigning strongly attested cryptographic identities to software workloads across heterogeneous infrastructure, including Kubernetes, virtual machines, public clouds, and private data centers. Workloads can use these identities for authenticated service-to-service communication through X.509 or JWT-based mechanisms, including mutually authenticated TLS and zero-trust authentication without passwords or API keys. SPIRE (SPIFFE Runtime Environment) is the companion toolchain that establishes trust and issues workload identities across hosting platforms. SPIFFE and SPIRE are graduated projects of the Cloud Native Computing Foundation.

Speakeasy is an AI control plane for discovering, securing, and governing enterprise AI agents, MCP servers, Skills, and AI applications. It maintains a catalog of approved AI tools, gives each agent an identity through the organization's existing identity provider, and scopes access by team and role. Every prompt, response, and tool call passes through the control plane for real-time policy checks before reaching internal APIs, MCP servers, or SaaS tools. Policies can distinguish read and write access and individual tools; violations are blocked, while allow-or-deny decisions are recorded in an audit trail. The platform is designed to detect and quarantine unapproved MCP connections and to block threats such as prompt injection, PII exposure, and leaked credentials in flight. Speakeasy deploys through an organization's existing MDM, including Jamf and Intune, and integrates with SAML/OIDC identity providers. The page states that it is SOC 2 Type II audited, ISO 27001 certified, GDPR compliant, and HIPAA ready.

Spin is an open-source framework and developer tool for building, deploying, and running secure, composable cloud microservices as WebAssembly components. Its CLI creates applications from templates, builds them to WebAssembly, runs them locally, and supports application distribution and execution using the WebAssembly component model and Wasmtime runtime. Spin provides supported SDKs for JavaScript, Rust, Go, and Python, with capabilities including HTTP and Redis triggers, outbound HTTP, configuration variables, key-value and database storage, and serverless AI features.

Flawless, also named CISRE (Cloud Infrastructure Site Reliability Engine), is an AI SRE and AgenticOps control plane for Kubernetes and cloud infrastructure. It connects risk discovery, evidence collection, diagnosis, Skill-based remediation, human approval, controlled changes, recovery verification, and auditable records into a remediation loop. Its architecture separates model planning and explanation from domain Skills, composable plugins, a Harness for state, permissions, and orchestration, controlled executors for real changes, and Verifiers that determine whether the target has actually recovered. The documented flow is discovery → evidence collection → diagnosis → Skill routing → change preview → human approval → execution → same-target readback → stability verification → records; if recovery fails, the system retains evidence and can continue with another strategy. Kubernetes is documented as having a complete loop, while database, VM/host, storage, middleware, cloud-resource, and network integrations are described as contract-ready extension areas. The platform includes SRE Run, scheduled or manual AI inspections, topology impact analysis, a Skill library, a plugin center, operational dashboards, and Agent Trace. Real changes must pass through a typed action, policy and blast-radius checks, human approval, an executor, same-target readback, a recovery verifier, and a record. Its plugin-first architecture supports declared service dependencies, event-driven orchestration, reversible loading and hot reload, event-sourced audit records, replay, fork, resume, and resource-domain agents.