Demystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
summary
Demonstrates that Istio ambient mesh gives mutual TLS without sidecars by simply label the namespace — no pod restarts. Uses k3s local clusters with flannel CNI, a ztunnel ambient proxy, SPIFFE identities, Kiali for visualization, and a Node.js/HTTPBin demo to show mTLS session keys, double encryption, and identity principals. Shows deny‑all plus explicit L4 and L7 allow policies enforced via a Waypoint (Gateway API) and verifies metrics/traffic graphs — the demo works end‑to‑end.
AI-written summary · about
chapters (12)
- 0:00Zero Trust and Istio Ambient intro
- 3:36Secure communication matters
- 7:51Mutual TLS core principles
- 9:55Demo setup and cluster overview
- 13:55Client-server in Kubernetes
- 14:57Manual Mutual TLS the hard way
- 21:38Enable Istio Ambient for auto mTLS
- 23:45Verify mTLS with metrics
- 26:57Deny-all zero trust policies
- 29:28Layer 4 auth policies
- 31:35Layer 7 auth with Waypoints
- 35:31Summary and resources
related talks
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
29mZero Trust for APIs: From Edge to Mesh with Istio
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
19mKeynote: Demystifying Secure Application Communication with Zero Trust: Identity, Integri...
31mTrust no one: implementing zero trust security with Ambient Service Mesh
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
44mA Guided Tour of ISTIO Ambient Mesh
42mSecuring Kubernetes Workloads with Istio Service Mesh