Lightning Talk: Running Arbitrary Code Safely with Istio
summary
Demo shows Istio enforcing network isolation so user-submitted code can reach the public internet but not cluster services. Creates a namespace and a single-replica Go container with curl, applies a sidecar egress policy that sets a deny-all then allow CIDR whitelist, observes internal payment service becomes unreachable then restores internet egress by adding GKE control-plane ranges. Hardest step is sourcing the exact GKE control-plane IPs; approach works but author still recommends a separate tenant cluster.
AI-written summary · about
related talks
05mLightning Talk: Speak Egress and Exit: A Look at Securing Traf...
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
39mRunning Resilient Workloads with Istio
42mSecuring Kubernetes Workloads with Istio Service Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
10mLightning Talk: Validating Your Istio Setups? the Tests Are Already Written
32mIstio: Sailing to a Secure Services Mesh
13mLightning Talk: Enhancing Security with Istio: Realtime JWT Access Revocation