Zero to Secure: Using Open Service Mesh to Easily...
summary
Demonstration shows Open Service Mesh delivering cluster-wide mTLS with two simple steps — osm install and adding a namespace — by injecting an Envoy sidecar into pods so traffic between services is encrypted without application changes. A tcpdump container initially reads plaintext and after the mesh is applied it sees nothing intelligible, proving the encryption works. The mesh also enforces the principle of least privilege via HTTPRouteGroup rules to restrict who can call which paths.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:27Speaker background
- 7:50Why security in Kubernetes
- 10:19Kubernetes attack surface
- 12:25Supply chain risks
- 16:42Service mesh security with mTLS
- 23:49Simplifying mTLS setup
- 24:31Live demo traffic encryption
- 29:28Least privilege enforcement
- 32:14Summary
related talks
06mLightning Talk: Securing Your Systems with Service Mesh
10mService Mesh Security in a Nutshell
41mKeynote: Open Service Mesh - Why, What, How?
30mIntroduction to Service Mesh for DevOps
31mTrust no one: implementing zero trust security with Ambient Service Mesh
21mProduction-Ready gRPC: How Service Meshes Simplify Security, Routing, and Observability
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
01h 03mJust what is a "service mesh", and if I get one will it make everything OK?