Zero Trusting as a True Cloud Native Dev
summary
Claim: Kubernetes can own Zero Trust authn/authz so application code stays clean. The demo wires Gateway API + Envoy as the ingress, cert-manager for TLS, a policy engine (Quadrant / Open Policy Agent pattern) and MetalLB, uses the Kubernetes TokenReview and SubjectAccessReview APIs plus RBAC-bound service accounts, and enforces TLS, authentication, authorization and rate limiting. Result: unauthenticated 401, authenticated-but-unauthorized 403, allowed 200, and a 2 requests per 10s rate limit that returns 429 when exceeded — it works end to end.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 1:53Cloud native and zero trust defined
- 6:13Zero trust architecture explained
- 10:10Proxies vs proxyless approaches
- 12:22Authentication methods overview
- 15:53Authorization models explained
- 16:57Gateway API introduction
- 21:00Recap and demo setup
- 22:30Live demo part 1: Basic setup
- 28:43Live demo part 2: Gateway API configuration
- 32:49Live demo part 3: Security layers
- 36:33Live demo part 4: Authentication and authorization
- 40:08Live demo part 5: Role-based access
- 41:15Live demo part 6: Rate limiting
- 43:28Summary and CNCF resources
related talks
35mDemystifying Zero-Trust for Cloud Native Technologies
29mZero Trust for APIs: From Edge to Mesh with Istio
01h 02mIntroduction to Zero Trust Security
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
29mZero Trust Security with Service Mesh
26mA DevSecOps Approach to Zero Trust Network Security
23mThe Long and Windy Road that leads to Cloud Native Security
38mToward Zero Trust with AI