Envoy SDS: Fortifying Istio Security
summary
Istio 1.1 uses an Envoy Secret Discovery Service (SDS) agent running as a sidecar/DaemonSet to provision x.509 keys from Citadel or external CAs so the private key never leaves the node and keys stay in memory rather than on disk. Ingress gateways query a local agent container which reads Kubernetes secrets or talks to cert-manager/Let's Encrypt and returns certs to Envoy over SDS, enabling certs delivered over SDS via local agent with no Envoy restart on rotation, and support for K8s and VM workloads.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:00SEO
- 3:17Overview Architecture
- 8:54Authentication Flow
- 10:59Legacy Cert Management
- 13:24What is SDS
- 14:18Managing external certificates
- 16:45Recap
- 18:11Integration
- 19:44Demo
- 31:49Questions
related talks
48mSecuring Kubernetes with Istio
32mIstio: Sailing to a Secure Services Mesh
34mIstio Certificate Management Through Vault
42mSecuring Kubernetes Workloads with Istio Service Mesh
43mHow the DoD Use Istio for End-to-End Encryption and Authentication
32mIstio: Weaving the Service Mesh [I]
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified