Zero Trust Service Mesh with Calico, SPIRE, and Envoy
summary
Builds a Zero Trust mesh by pairing Envoy sidecars with SPIRE-issued identities and Calico policy. SPIRE uses the Kubernetes workload attestor, exposes certs via SDS to Envoy, and rotates short-lived SPIFFE identities automatically; Envoys perform mutual TLS between proxies. Calico’s Felix computes per-pod rules and a Decider plugin enforces them at request time (Calico Felix + Decider policy enforcement). Demo shows kubectl exec to exfiltrate DB, then applying Calico policy returns 403 from Envoy, blocking access.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:00What is Zero Trust
- 14:30Example
- 15:20Calico
- 18:22Demo
- 19:51Demo Time
- 20:47SPIRE Server Deployment
- 22:49Kubernetes Workload Tester
- 24:22Kubernetes Services
- 27:35Calico Network Policy
- 30:47Calico Policy Controller
- 32:43SPIRE Multiple Roots of Trust
- 33:27SPIRE vs Citadel
- 35:07Establishing Trust
- 36:27Debugging Issues
- 37:15Health Check
- 37:53SPIRE Updates
- 38:53Calico Updates
related talks
41mZero-Trust Networks: Identity, AuthN, AuthZ, Audit
31mBridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity
32mIstio: Sailing to a Secure Services Mesh
27mBridging Trust Between Multi-Cluster Meshes
26mA DevSecOps Approach to Zero Trust Network Security
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
28mService Identity - The Key to Zero Trust with Service Mesh