Authentication and Security in gRPC Microservices
summary
Explains concrete gRPC auth patterns: per-call JWT bearer tokens (or opaque OAuth2 tokens) on top of TLS, channel-level mutual TLS with client certificates, and transparent delegation via Istio sidecars (Pilot, Citadel, Envoy) using Kubernetes Secrets and ServiceAccounts for identity and automated cert rotation. Demo deploys four scenarios—TLS, JWT+TLS, manual mTLS, and Istio mTLS—showing manual cert management breaks easily while Istio’s sidecars handle mTLS automatically; examples and scripts live on GitHub and mostly run except one demo hiccup.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:38Agenda
- 2:19Key Ideas
- 4:31What is gRPC
- 6:16Authentication Methods
- 8:44Authentication with Tokens
- 12:09Secure Channels
- 13:51Mutual TLS
- 15:56Kubernetes primitives
- 18:08Examples
- 19:27Demo
- 21:26Deployment
- 23:55Creating the client
- 25:05Replacing the existing server
- 25:58Replacing the old clients
- 26:31Testing the new clients
- 29:36Outro
related talks
30mSecuring Your Services with Authentication, Authorization, and RBAC in gRPC
26mFortifying gRPC Microservices: Beyond JWT with mTLS and SPIFFE
23mAuthentication and Authorization in Micro Services
22mThe Security Evolution of gRPC Services in the Mesh - Amim Knabben, VMware
43mSecuring the Service to Service Call Chain Patterns and Protocols
10mService Mesh Security in a Nutshell
29mThe Security Evolution of GRPC Services in the Mesh
42mSecuring Kubernetes Workloads with Istio Service Mesh