Securing Kubernetes Workloads with Istio Service Mesh
summary
Shows how Istio deploys an Envoy sidecar per pod, issues short lived X509 certs via the control plane SDS, and enforces service identities so mTLS strict drops nonmesh traffic as demonstrated by a sleep pod being reset. Covers sidecar injection modes, ingress gateway TLS modes including ingress passthrough, and a live nginx passthrough demo that succeeds only with correct certs. Demonstrates authorization policies that default deny and allow GET from inventory to s while POST is forbidden.
AI-written summary · about
chapters (26)
- 0:00intro
- 1:43preamble
- 2:06talk outline
- 2:35what is a service mesh
- 3:27istio features
- 4:32important terminology
- 4:57before istio
- 5:37pod with sidecar
- 6:25sidecar proxy
- 7:07how is the sidecar injected
- 7:57with istio - sidecar intercepts all traffic
- 8:29istio architecture
- 9:26service mesh security
- 9:37service identities - the starting point
- 10:52conversion of identity into a certificate
- 11:52identity provisioning workflow
- 12:23authentication
- 13:42auth flow
- 14:35peer authentication
- 15:48demo
- 22:22ingress gateway
- 26:07demo
- 32:32authorization
- 34:39auth flow
- 35:15demo
- 41:22questions?
related talks
32mIstio: Sailing to a Secure Services Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
48mSecuring Kubernetes with Istio
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
43mService Mesh for developers
52mMaking microservices micro with Istio Service Mesh & Kubernetes- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
50mService Mesh and Sidecars with Istio and Envoy