Node Trust in Kubernetes Workload Identity: A SPIFFE/SPIRE Defense Model

Explains why short-lived SPIFFE/SPIRE SVIDs still depend on node integrity, what a laboratory cgroup-spoofing test showed, and which Kubernetes controls can limit the impact.