Advanced Authentication patterns at the Edge
summary
Shows a Kubernetes-native API gateway approach that moves OIDC, JWT validation, rate‑limiting and WAF to the edge so apps only see simple headers. Uses Envoy (gateway filters), a control plane called glue mesh/glue edge that replaces the Istio gateway image, and an external IdP (Keycloak). Demo performs OIDC redirect, creates a verified X-Email header from the JWT, enforces an OPA policy via OPA code (deny non‑solo.io emails), applies a 3 requests/min per‑organization rate limit, and blocks exploits with mod_security WAF — all working end‑to‑end.
AI-written summary · about
chapters (16)
- 0:00Advanced authentication intro
- 1:07K8s ingress controller challenges
- 4:17API gateway auth on K8s
- 7:06K8s-native API gateways
- 9:14Service mesh for services
- 11:20Envoy auth workflows
- 13:45Gloo Edge features
- 16:35Demo setup K8s Istio
- 17:17Secure services with Gloo Mesh
- 19:09OIDC auth with Gloo Mesh
- 23:24JWT token handling
- 26:16Regex header transforms
- 29:27Enforcing rate limits based on organization
- 31:39WAF with Gloo Mesh
- 33:47Securing apps at edge summary
- 34:30Q&A
related talks
27mAdvanced Authentication patterns at the Edge
03h 18mHands-On with an Envoy API Gateway, Now with GraphQL!
26mOne Auth Gateway to authenticate them all
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
49mProtecting API workloads OWASP Top 10
55mMastering GraphQL: Strategies from the Experts
27mCentralise legacy auth at the ingress gateway
26mStreamlining API Governance: Kubernetes Native API Management