Leveraging Envoy to Implement Micro-Segmentation-Based Security Policies
summary
JPMorgan implements micro‑segmentation by validating and exchanging tokens at Envoy using JWT Authentication and an External Processor gRPC service written in Go that mints upstream tokens and runs over Unix Domain Sockets. Envoy replaces brittle custom proxies, yields cost and performance gains, and the setup runs in production for half a year in production while the Envoy config has grown to 1200 lines of YAML across ~100 developers.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:50Companywide security policy
- 4:29Filter chain
- 6:15UDS support
- 12:45Challenges
- 19:05WebAssembly
related talks
10mOverview of Authentication and Authorization Features in Envoy
28mAuthorization with Envoy
21mDeep Dive: Envoy
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
32mBuilding Zero Trust with Envoy
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
15mTaming AI Sprawl: Your First Look at the Envoy AI Gateway
36mSecuring Every Bit