Lightning Talk: How to deploy mutually authenticated TLS without ruining everything
summary
Shows how to enable mutual TLS using Envoy/Istio with a concrete three-step rollout: first set servers permissive to accept both plaintext and mTLS, then flip clients start transmitting TLS, then set servers strict to deny plaintext. Demonstration uses Istio XDS changes but observes spikes of 5xx errors (hundreds of failed requests) when trying to switch live with ~50 RPS, so rolling redeploys (server, client, server) are recommended until dynamic config behaves reliably.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:34Strategy and challenges
- 3:04Live demonstration failures
- 5:01Testing the phased approach
- 7:26Locking down mTLS
- 8:53Conclusions and Q&A
related talks
05mLightning Talk: Speak Egress and Exit: A Look at Securing Traf...
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
37mSecuring Cloud Native Communication, From End User to Service
06mLightning Talk: Securing Your Systems with Service Mesh
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
38mEmbracing the Future: The Effortless Mutual TLS and Rich Layer 7 Authz Policy Without Sid...