Trust no one: implementing zero trust security with Ambient Service Mesh
summary
Demonstrates implementing Zero Trust using Istio's Ambient Service Mesh by replacing per-pod sidecars with a proxy-per-node ztunnel that handles mTLS and certificate issuance, while keeping Layer 7 Envoy proxies only where needed. Claims a roughly 10x reduction in sidecar count and CPU/memory overhead, lowers blast radius, and delegates certs to a Rust-based node proxy. Maps features to NIST SP 800-207 controls and shows the architecture working end-to-end for automated policy enforcement.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 4:21Why zero trust matters
- 8:16Zero trust core principles
- 12:36Policy as code
- 15:25NIST and MIT frameworks
- 17:37Policy enforcement
- 18:39Microservices and service mesh
- 21:09What is service mesh
- 22:54Istio and Envoy
- 25:07Sidecar proxy challenges
- 26:11Ambient service mesh
- 27:16Ztunnel reduces complexity
- 29:49Security and efficiency benefits
related talks
29mZero Trust for APIs: From Edge to Mesh with Istio
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
25mWhat's a Zero-Trust Tunnel? SimpleOps and SecOps with Ambient Mesh
22mIs Istio Ambient Mesh Secure?
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
42mAmbient Mesh: new sidecar less & faster Istio for zero trust