Army of Proxies! How Netflix scales identity based zero trust...
summary
Netflix describes a decade of moving from VPN+SSO to identity-first perimeter, replacing homegrown pieces with off‑the‑shelf and custom components: Kong and Kubernetes ingress at the edge, Envoy plus an OPA‑like sidecar (Gandalf) for mTLS and service auth, Spinnaker with a Manage Delivery plugin to automate gateway and OIDC client setup, and tools like Repo‑Kid and Squash to repossess stale perms. The stack already blocks large incidents (Log4j), gives centralized logs and session revocation, and reduces help‑desk load (≈30% of tickets are access requests).
AI-written summary · about
chapters (11)
- 0:00Introduction and context
- 5:31Evolution of Netflix network
- 7:25The zero trust cast
- 9:15Edge and identity
- 11:52Managing user identity
- 12:58Service mesh bodyguards
- 14:18The control plane
- 15:49Developer integration
- 17:45Organizational adoption
- 19:25Conclusion and impacts
- 20:33Q&A session
related talks
28mBuilding Identity for an Open Perimeter
23mZero Trust: From Airports to Identity-Aware Proxies
36mHow Netflix Is Solving Authorization Across Their Cloud [I]
47mCloud Security at Scale and What it Means for Your Application
32mImplementing Zero Trust
19mZero Trust: From Airports to Identity-Aware Proxies
17mRelationship Therapy: Keeping Developers and Security Teams Happy
23mHow to Secure Microservices Without Traditional Firewall