Using application identity to correlate metrics: A look at SPIFFE and SPIRE

Description

With the explosion of open source tooling for logging (e.g., Fluentd), monitoring (e.g., Prometheus), and tracing (e.g., OpenTracing, Zipkin, and Jaeger), there have never been more ways to observe and introspect application behavior. Often, quickly identifying and resolving application pathologies requires several of these tools to be used in concert. But in a world where software can be deployed in many different ways (such as clusters, VMs, containers, and functions), understanding which metrics correlate to behavior in different applications can be difficult.

In an ideal world, we would have a standardized way to identify running software systems that our monitoring tools could easily lean on, even when spread over multiple teams, geographies, and platforms. But real-world deployments are rarely so simple. Priyanka Sharma and Sabree Blackmon explain how application identity can be used as the basis for correlating metrics from multiple sources (with the help of OpenTracing) and detail some of the challenges inherent in defining application identity in different contexts (such as virtual machines, functions, and different Kubernetes primitives). They then offer an overview of open source projects like SPIFFE and SPIRE, which have modernized identity authentication across microservices, and demonstrate how SPIRE, Fluentd, Prometheus, and Zipkin can be used together to precisely correlate logs, metrics, and traces to improve and diagnose real-world production issues.