Securing the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 14:15· Level 3 | ICC Capital Suite 10-12·
summary
Envoy Gateway v1.3 exposes a SecurityPolicy CRD that maps to Envoy configs and enforces CORS, Basic Auth, API Key, External Auth, OIDC via Amazon, and JWT claim checks without editing Gateway API resources. Policies apply at gateway or route level; an 11-line YAML can register an OIDC provider and a cookie for ID tokens, and a demo shows claim-based allow/deny (email/sub) working end-to-end. Also demonstrates a Keycloak backend via a Backend resource; repo includes the demo files and runs in about five minutes.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:55Envoy Gateway purpose
- 3:02Security policies overview
- 4:28Supported security policies
- 6:17Two-level policy structure
- 9:19OIDC authentication in practice
- 11:33Live demo setup
- 14:07OIDC with Amazon Cognito
- 16:51JWT claims and rules
- 20:42Self-hosted identity providers
- 23:20Keycloak integration demo
- 25:12Key takeaways and resources
related talks
36mAdvanced Authentication patterns at the Edge
05mKeynote: Envoy, the Engine for a Cloud Native Security Kernel
15mTaming AI Sprawl: Your First Look at the Envoy AI Gateway
33mOne Size Doesn’t Fit All: Adding Org-Specific Gateway API Extensions with Envoy Gateway
32mOne Size Doesn’t Fit All: Adding Org-Specific Gateway API Extensions with Envoy Gateway
26mGuard Your Network With Kyverno and Envoy
29mEnvoy Gateway End User Threat Model Report: Raising Awarenes...
10mOverview of Authentication and Authorization Features in Envoy