Securing Every Bit
summary
Uber implements transparent mTLS, authentication and authorization across Envoy fronting every TCP connection using eBPF and nftables plus a runC wrapper and Spire for identities. The rollout reaches billions of established connections and ~tens of millions of new connections per second, covering ~40% of traffic today with ~0.5% fallback to plaintext. Key fixes: adaptive connection queuing (avoids 500ms P99 spikes), TLS session-key caching, original-destination batching; overall platform runs at zone scale and stays available during incremental rollouts.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:04Zero trust at Uber
- 2:05Why securing every bit was hard
- 4:35Core tenants of our approach
- 6:01Encrypted data plane with Envoy
- 9:11Proxy protocol details
- 12:45Graceful degradation strategies
- 13:29Rolling out to production
- 16:40Stability during rollout
- 17:41Current adoption at Uber
- 19:07Performance challenges
- 23:20TLS handshake latency
- 26:54Connection queuing and kernel bottlenecks
- 28:42TLS session reuse and caching
- 30:29Original destination bottlenecks
- 31:56Q&A
related talks
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
26mDisrupting Malicious Traffic with Egress Proxies
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
32mBuilding Zero Trust with Envoy
42mAccelerating Envoy with the Linux Kernel
35mEnvoy Maintainer Q+A
29mUnderstanding, maintaining and securing Envoy's supply chain
32mImplementing Zero Trust