Workload - Revision history

Tom: /* Context */

2025-09-28T22:37:31Z

‎Context

Tom: /* Identification */

2025-08-12T23:33:21Z

‎Identification

Tom: /* Context */

2025-08-12T19:29:48Z

‎Context

Tom: /* Definition */

2025-08-12T19:26:16Z

‎Definition

Tom: /* Context */

2025-08-12T19:25:18Z

‎Context

Tom: /* Context */

2025-08-12T01:20:22Z

‎Context

Tom: /* Definition */

2025-08-12T01:05:32Z

‎Definition

Tom: /* References */

2025-07-07T16:10:52Z

‎References

Tom: /* References */

2025-07-07T16:07:51Z

‎References

Tom: Created page with "==Definition== Workload In the IAM taxonomy (see earlier post), all user constituencies and IAM domains present challenges and struggles, but the Workload IAM domain..."

2025-07-07T16:07:09Z

Created page with "==Definition== Workload In the IAM taxonomy (see earlier post), all user constituencies and IAM domains present challenges and struggles, but the Workload IAM domain..."

New page

==Definition==
[[Workload]]

In the IAM taxonomy (see earlier post), all user constituencies and IAM domains present challenges and struggles, but the [[Workload]] IAM domain exceeds the others in that regard. The industry is lacking a good taxonomy of what constitutes a workload or a workload identity. Gartner categorizes workloads into four related (and interconnected!) user constituencies — services, applications, virtual machines (VMs), and containers. All four need IAM strategies.

The following examples explain the relationships and the concepts further and why each of the four types of workload need to be treated distinctly in an IAM taxonomy:
- A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster. Each container is represented by using a Secure Production Identity Framework for Everyone (SPIFFE) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control. The VM, Kubernetes, and the container are the infrastructure components that host a service, exposing a business API, requiring server credentials in the form of a certificate to terminate TLS. Like many applications, the service will also need client credentials in the form of API keys or database connection strings to connect to third-party systems.
- An AI agent is an application, acting on behalf of a human, to call a third-party service using an OAuth access token. Each AI agent requires its own workload identity (e.g., in the model context protocol [MCP], acquired using OAuth 2.0 Dynamic Client Registration) to authenticate the AI agent against the identity provider. The AI agent is also using a legacy (and always sub-par) API key to talk to a third-party service needing management.

In summary, VMs, containers, services, and applications are often connected and dependent on each other while all needing distinct IAM strategies.
==References==

[[Category: Computing]]

@@ Line 6: / Line 6: @@
 The following examples explain the relationships and the concepts further and why each of the four types of workload need to be treated distinctly in an IAM taxonomy:
-# A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster. Each container is represented by using a Secure Production Identity Framework for Everyone (SPIFFE) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control. The VM, Kubernetes, and the container are the infrastructure components that host a service, exposing a business API, requiring server credentials in the form of a certificate to terminate TLS. Like many applications, the service will also need client credentials in the form of API keys or database connection strings to connect to third-party systems.
+# A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster. Each container is represented by using a Secure Production Identity Framework for Everyone ([https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md SPIFFE]) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control. The VM, Kubernetes, and the container are the infrastructure components that host a service, exposing a business API, requiring server credentials in the form of a certificate to terminate TLS. Like many applications, the service will also need client credentials in the form of API keys or database connection strings to connect to third-party systems.
 # An AI agent is an application, acting on behalf of a human, to call a third-party service using an OAuth access token. Each AI agent requires its own workload identity (e.g., in the model context protocol [MCP], acquired using OAuth 2.0 Dynamic Client Registration) to authenticate the AI agent against the identity provider. The AI agent is also using a legacy (and always sub-par) API key to talk to a third-party service needing management.

@@ Line 14: / Line 14: @@
 ==Identification==
 Persistence of the Identity of an Identified workload is not guaranteed by the current proposal where each container is represented by using a Secure Production Identity Framework for Everyone (SPIFFE) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control.
 ==References==
 [[Category: Computer]]

@@ Line 3: / Line 3: @@
 ==Context==
-In the IAM taxonomy, all user constituencies and IAM domains present challenges and struggles, but the [[Workload]] IAM domain exceeds the others in that regard. The industry is lacking a good taxonomy of what constitutes a workload or a workload identity. Gartner categorizes workloads into four related (and interconnected!) user constituencies — services, applications, virtual machines (VMs), and containers. All four need IAM strategies.
+In the IAM taxonomy, all user constituencies and IAM domains present challenges and struggles, but the [[Workload]] IAM challenges may be the most difficult. The industry is lacking a good taxonomy of what constitutes a workload or a workload identity. Gartner categorizes workloads into four related (and interconnected!) user constituencies — services, applications, virtual machines (VMs), and containers. All four need IAM strategies.
 The following examples explain the relationships and the concepts further and why each of the four types of workload need to be treated distinctly in an IAM taxonomy:
-# A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster.
+# A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster. Each container is represented by using a Secure Production Identity Framework for Everyone (SPIFFE) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control. The VM, Kubernetes, and the container are the infrastructure components that host a service, exposing a business API, requiring server credentials in the form of a certificate to terminate TLS. Like many applications, the service will also need client credentials in the form of API keys or database connection strings to connect to third-party systems.
 # An AI agent is an application, acting on behalf of a human, to call a third-party service using an OAuth access token. Each AI agent requires its own workload identity (e.g., in the model context protocol [MCP], acquired using OAuth 2.0 Dynamic Client Registration) to authenticate the AI agent against the identity provider. The AI agent is also using a legacy (and always sub-par) API key to talk to a third-party service needing management.

@@ Line 1: / Line 1: @@
 ==Definition==
-[[Workload]]A computer [[Workload]] refers to the set of tasks, processes, or operations that consume computing resources—such as CPU, memory, storage, and network bandwidth—to achieve a specific outcome. It’s essentially the demand placed on a system by applications, services, or users at any given time.
+A computer [[Workload]] refers to the set of tasks, processes, or operations that consume computing resources—such as CPU, memory, storage, and network bandwidth—to achieve a specific outcome. It’s essentially the demand placed on a system by applications, services, or users at any given time.
 ==Context==
 In the IAM taxonomy, all user constituencies and IAM domains present challenges and struggles, but the [[Workload]] IAM domain exceeds the others in that regard. The industry is lacking a good taxonomy of what constitutes a workload or a workload identity. Gartner categorizes workloads into four related (and interconnected!) user constituencies — services, applications, virtual machines (VMs), and containers. All four need IAM strategies.

@@ Line 5: / Line 5: @@
 The following examples explain the relationships and the concepts further and why each of the four types of workload need to be treated distinctly in an IAM taxonomy:
-- A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster. Each container is represented by using a Secure Production Identity Framework for Everyone (SPIFFE) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control. The VM, Kubernetes, and the container are the infrastructure components that host a service, exposing a business API, requiring server credentials in the form of a certificate to terminate TLS. Like many applications, the service will also need client credentials in the form of API keys or database connection strings to connect to third-party systems.
+# A VM deployed in Microsoft Azure has an Azure-managed identity assigned to it. An Azure-managed identity includes the account, and Azure ensures that it has up-to-date credentials to help the VM identify itself to other services in Azure. The VM is running a self-managed or test/dev Kubernetes cluster.
-- An AI agent is an application, acting on behalf of a human, to call a third-party service using an OAuth access token. Each AI agent requires its own workload identity (e.g., in the model context protocol [MCP], acquired using OAuth 2.0 Dynamic Client Registration) to authenticate the AI agent against the identity provider. The AI agent is also using a legacy (and always sub-par) API key to talk to a third-party service needing management.
 In summary, VMs, containers, services, and applications are often connected and dependent on each other while all needing distinct IAM strategies.
 [[File:Workload.jpg]]
 ==Identification==
 Persistence of the Identity of an Identified workload is not guaranteed by the current proposal where each container is represented by using a Secure Production Identity Framework for Everyone (SPIFFE) environment that issues SPIFFE Verifiable Identity Documents (SVIDs) used for access control.

← Older revision		Revision as of 16:07, 7 July 2025
Line 11:		Line 11:
	==References==		==References==

−	[[Category: ~~Computing~~]]	+	[[Category: Computer]]