From Kubelet to Istio: Kubernetes Network Security Demystified
summary
Covers how Kubernetes implements TLS and x.509 chains for API server and etcd, demonstrates one-hour certificate rotation for short lived leaf certs, and shows how CNI network policies enforce L3/L4 restrictions while a simple nmap-in-namespace tool verifies rules. Describes bootstrapping short lived identities with SPIFFE/Spire, and how Istio + Envoy use those identities to provide mutual TLS between workloads, yielding automated mTLS that isolates a compromised pod to its preset peers.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:25What is Network Security
- 0:42Why do we need Network Security?
- 0:56Happy Path Application Design
- 1:49Takeaway: Encrypt Everything Everywhere
- 8:04Securing API Server Traffic
- 11:14Woah there, how does it work?
- 13:20The Original Crypto!
- 14:40X.509 Example Cert
- 15:09Self Signed Certs aka Signing Your Own Homework
- 16:05One-Way (Traditional) TLS Handshake
- 16:35Mutual TLS Handshake (TLS)
- 18:04Zero Trust Networking
- 18:22Zero Trust API Server?
- 22:06Containers and Traditional Network Security?
- 24:21netassert - cloud native network testing
- 25:10Cloud Native Dynamic Firewalls
- 29:43X.509 RFC Format
- 29:56Certificate Path Validation
- 31:05Using SPIFFE in TLS Certificates
- 32:12End to End Encryption
- 33:20Conclusion
related talks
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
42mSecuring Kubernetes Workloads with Istio Service Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
32mIstio: Sailing to a Secure Services Mesh- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
46mContinuous Kubernetes Security
48mSecuring Kubernetes with Istio
57mThe Kubernetes Sessions Security