Network Security at Scale: L3 Through L7 at Splunk
summary
Splunk runs about 35 clusters across AWS and GCP with one VPC per cluster, uses public/internal NLBs plus Transit Gateways and Aviatrix for a flat L3 fabric, enforces subnet ACLs and security groups, and centralizes ingress on Envoy gateways. Kubernetes uses validating webhooks and a service abstraction controller that generates VirtualService/DestinationRule/Gateway and certificates. Istio provides mTLS (permissive) via Envoy sidecars per pod and xDS ext_auth; cost and restart pain points drive a move to Ambient (node DaemonSet Z tunnel) to reduce proxies and simplify upgrades.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:16Standard VPC
- 3:09Network ACLS
- 4:25Kubernetes nodes
- 5:03Security Groups
- 6:02Ingress connectivity
- 6:46Internal connectivity (transit gateway)
- 7:15Cloud connectivity (Aviatrix)
- 7:54Aviatrix Network Domains
- 8:27Kubernetes deployment
- 9:37ValidatingWebhook
- 10:40NetworkPolicies on K8S
- 11:51Istio Service Mesh
- 14:22Gateway provisioning
- 15:44Ingress setup
- 16:36Service abstraction layer
- 17:47Layer7 Authentication
- 20:35Life of an ingress request
- 22:27Running One Proxy Per Instance
- 23:13Managing the Magic
- 24:11Ambient Reduces User Pain
- 25:39Defense at Every Layer
related talks
31mEffective building blocks for securing...
32mService Networking Within Air-Gapped Environments: Deployment Strategies and Operat...
42mscales security capabilities with Splunk and
37mKubernetes Security and How to Fix K8s Cluster at Scale
41mCloud Native Security For The Rest Of Us
57mThe Kubernetes Sessions Security
40mReimagining Application Networking and Security
24mAnalytics-based investigation & automated response