Understand SPIFFE SVID types (X.509-SVID and JWT-SVID) and when to use each

Steps

1. Learn that a SPIFFE Verifiable Identity Document (SVID) is the cryptographic proof of a workload's SPIFFE ID (a URI of the form spiffe://<trust-domain>/<path>)
2. Understand X.509-SVIDs: a short-lived TLS certificate where the SPIFFE ID is encoded in the certificate's SAN URI field; used for mTLS connections where both parties present certificates
3. Understand JWT-SVIDs: a short-lived signed JWT with the sub claim set to the SPIFFE ID; used for HTTP API calls or contexts where TLS certificate presentation is not possible
4. Choose X.509-SVIDs for service-to-service mTLS as they integrate with standard TLS stacks and require no custom HTTP header handling
5. Choose JWT-SVIDs for cases where only application-layer identity is needed (e.g., an HTTP API call through a proxy that terminates TLS) or when the consumer validates a bearer token
6. Both SVID types are delivered by the SPIFFE Workload API (a local Unix domain socket) and have short TTLs; workloads must refresh them automatically before expiry