Tutorial: Hacking Istio: The Good, the Bad, and the Misconfigured
summary
Hands‑on lab exposes real Istio misconfigurations: clusters come preinstalled with Ambient mode and vulnerable policies to exploit, and participants must chain three vaults to retrieve one flag across three vaults. Policies actually used include Gateway API HTTPRoute, Istio AuthorizationPolicy and RequestAuthentication, plus a custom external authorizer; enforcement shifts to the L4 z tunnel per node and optional L7 waypoint. Tools and steps are concrete: kubectl, curl, ssh, construct a JWT from an RSA private key, edit AuthorizationPolicy, and the exercise completes in staged 20‑minute acts.
AI-written summary · about
chapters (10)
- 0:00Presenters and Istio intro
- 4:19Gateway API policy
- 6:46Auth and request auth
- 8:34Kubectl tips
- 10:22Istio Springs setup
- 13:13Act 1: Escaping jail
- 18:20Act 2: Safe house exploration
- 25:02Act 3: Unlocking saloon
- 31:03Act 4: Bank vault break-in
- 38:53Challenge summary
related talks
33mTutorial: Hack My Mis-Configured Kubernetes
31m(Almost) Secure by Default - Next Steps for Hardening Istio in Production...
28mA Not-so-Scary Way to Add Istio to Your Platform, Step by Step
32mIstio: Sailing to a Secure Services Mesh
42mSecuring Kubernetes Workloads with Istio Service Mesh
01h 07mTutorial: Bullet-Proof Kubernetes: Learn by Hacking
01h 13mTutorial: Hands-on Hacking Kubernetes and Ways to Prevent It
39mRunning Resilient Workloads with Istio