Platform & DevOps·Secrets, identity and the supply chain
the service proves what it is to the cloud without holding any credential, because the platform attests to it.
Workload identity
Also calledservice identity, SPIFFE identity, pod identity
Giving a running workload a cryptographic identity derived from where and what it is, which other systems can verify, instead of a shared secret it must carry. It is what eliminates long-lived keys in application configuration and what makes mutual TLS between services possible without a certificate distribution problem. It also makes authorisation legible, since policies name the service rather than an opaque key.