Improving Secure Pod-to-Pod Communication Within Kubernetes Using...
summary
Deploys a mutating admission webhook that creates a Kubernetes CSR per pod, approves it via any Kubernetes CSR signer (cert-manager, Vault, etc.), and injects the resulting certificate and a scoped cluster trust bundle as mounted files so each pod has per-pod TLS keys and CA roots. Demonstrates end-to-end mTLS for gRPC and HTTP using SPIFFE identifiers and DNS SANs, contrasts this with sidecars/service-meshes that can fail open, and proposes a CSI-based node-local private key generation path to avoid moving keys through the control plane.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:37What is a TrustBundle?
- 2:22Brief detour - Certificate Authorities
- 3:26How to use TrustBundles?
- 5:24Limiting Trust Scope
- 8:00Secure Networking on Kubernetes
- 11:30Unpacking what is KubeTLS
- 13:43What not to do
- 19:02KubeTLS Certificate Creation Details
- 20:37KubeTLS X.509 Key Fields
- 31:18Future Directions
related talks
32mAchieving Mutual TLS: Secure Pod-to-Pod Communication Without the Hassle
46mContinuous Kubernetes Security
15mSecuring your app's communications with Kubernetes, Azure Key Vault, and TLS certificates
32mIstio: Sailing to a Secure Services Mesh
42mSecuring Kubernetes Workloads with Istio Service Mesh
27mPragmatic Pod Patterns: Leveraging sidecar containers in Kubernetes
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
24mOne stop talk for kubernetes security !!