What's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...
summary
Istio Ambient Mesh introduces a sidecarless mode where a per-node ztunnel DaemonSet forms hbone TCP-over-HTTP tunnels and derives workload identity to create end-to-end mTLS, while optional Envoy-based waypoint proxies enforce Layer 7 via the Gateway API. Demo shows namespace activation without pod restarts, a deny-all Layer 4 policy then explicit allow-chains restoring calls, and a Layer 7 rule permitting GET but denying DELETE with an HTTP 403. Project is experimental but claims lower CPU/memory, smaller blast radius, and simpler upgrades.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:57Istio enables Zero-Trust Security
- 4:32How does it work (secure overlay only)?
- 5:27How does it work (secure overlay + L7)?
- 6:20Benefits
- 9:26Authorization Policy with Istio Ambient
- 9:55How ztunnel gets certificates
- 11:35How communication is secured through waypoint proxy
- 12:54App compromise (ambient)
- 13:29Smaller exposure for secure overlay/ztunnel
- 14:14Node compromise (ambient)
- 31:40Recap
related talks
25mWhat's a Zero-Trust Tunnel? SimpleOps and SecOps with Ambient Mesh
29mZero Trust for APIs: From Edge to Mesh with Istio
31mTrust no one: implementing zero trust security with Ambient Service Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
22mIs Istio Ambient Mesh Secure?- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
32mImplementing Zero Trust in a Kubernetes Cluster with Istio