Building Zero Trust with Envoy
Talkat EnvoyCon NA 2024 · on Tuesday, 2024-11-12· at 09:45· Hyatt Regency | Level 2 | Salt Lake Ballroom C·
summary
An enterprise-grade, multi-tenant clientless ZTNA proxy is built with Envoy on top of VPP, deployed across 30 data centers and capable of 4.5 Gbps per client. It supports HTTP/HTTPS plus in‑browser SSH and RDP, moves from WASM to a native C++ async downstream filter, solves the 10k–20k clusters problem by injecting stream metadata from the control plane into clusters, achieves roughly 10x–20x scaling, and implements on‑demand TLS via a certificate selector and SDS.
AI-written summary · about
chapters (9)
- 0:00Zero Trust and Envoy intro
- 1:03Clientless Zero Trust Access
- 3:14Why Envoy for Zero Trust
- 7:12Scaling Envoy clusters
- 10:49C++ filters for architecture
- 13:23Envoy with your domain
- 16:35RDP and SSH support
- 17:39Envoy implementation lessons
- 21:47Q&A
related talks
33mGet to know Envoy - the modern proxy for cloud-native infrastructure - Baptiste Collard
39mProtect Your Application, Not the Network. Add Zero Trust Superpowers to Your Critical...
25mWhat's a Zero-Trust Tunnel? SimpleOps and SecOps with Ambient Mesh
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...
32mRethinking the Proxy Model: Implementing Envoy as a Node-Scoped Agent
34mIntro: Envoy
36mSecuring Every Bit
46mZero Trust Cloud VPN Based on VPP and WireGuard