Implementing Zero Trust in a Kubernetes Cluster with Istio
summary
A demonstration of implementing Zero Trust in hybrid Kubernetes using Istio with SPIFFE/SPIRE and NGAC. It shows Envoy sidecars and Ambient Mesh enforcing mTLS and propagating JWTs, blocking all outbound traffic by default while allowing specific GETs from service A to HTTPBin. The setup includes Kind for demo, Cilium/Hubble for L3–L4 visibility, Prometheus/Grafana and Jaeger for telemetry, and a load test measuring functional overhead and resilience trade-offs.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 5:00Classical security issues
- 7:30Zero Trust principle
- 9:38Kubernetes security limits
- 13:05Istio’s security role
- 16:39Live demo
- 29:41Q&A
related talks
29mZero Trust for APIs: From Edge to Mesh with Istio
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
31mTrust no one: implementing zero trust security with Ambient Service Mesh
45mIstio and Cilium: Pushing the Boundaries of the Possible on Zero-Trust- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...
46mSecure your Microservices with ZeroTrust approach