Kryptkeeper
Feature

Machine and workload identity

Identities for workloads, SSH and code signing in the same place.

Approve machine identities before they exist, issue SPIFFE SVIDs to workloads, sign SSH certificates, and keep code-signing certificates in their own inventory.

kryptkeeper.example.com/nhi

How it works

  1. Propose and approve a machine identity

    One person proposes a machine identity and another approves it.

    8 steps

  2. Issue SPIFFE SVIDs

    Issue workload identities from a signing CA.

    4 steps

  3. Issue SSH certificates

    Sign SSH user and host certificates.

    7 steps

  4. Use the code-signing inventory

    Track code-signing certificates and who may use them.

    2 steps

Docs

Paths that use this