Encryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 15:00· Level 1 | Hall Entrance N10 | Room E·
summary
Explains why cluster-scale segmentation fails today and which tools actually close the gaps: Cilium NetworkPolicy and Istio AuthorizationPolicy add L4/L7 enforcement and clusterwide rules but differ on egress, logging, and identity handling. Recommends immutable identities like service account identity or pod TLS certs (KEP for pod certificates/CAP 43) and transmitting them over mTLS certificates for reliable AuthN/AuthZ; points out label-based policies break at 20k pods, create eventual consistency, and need admission controls.
AI-written summary · about
chapters (16)
- 0:00Encryption and identities
- 1:24Security breaches from weak links
- 4:34Kubernetes network policy basics
- 7:26Admin network policy control
- 9:32Gaps in network policy
- 10:35Identity-based security
- 13:04Kubernetes service accounts
- 14:49Identity in network packets
- 15:32Cilium and Istio policies
- 19:06Standardizing network identities
- 20:32Zero trust security steps
- 21:55Zero trust preventing breach
- 22:57Kubernetes identity standards
- 24:26Q&A: Dynamic authorization
- 26:58Q&A: Observability for policies
- 28:43Q&A: Beyond X.509 certificates
related talks
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
46mContinuous Kubernetes Security
34mTowards a Standardized Identity-based Authorization in Kubernetes
24mOne stop talk for kubernetes security !!
35mCloud Native Security for the Rest of Us
43mKubernetes Security: Attacking and Defending Modern Infrastructure
22mSecuring Kubernetes
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...