Guard Your Network With Kyverno and Envoy
summary
Kyverno Envoy Plugin attaches to Envoy sidecars and Envoy Gateway and delegates checks to a local gRPC Kyverno Authz Server on port 9081, evaluating an AuthorizationPolicy CRD written in CEL with variables, deny-first logic and failurePolicy set to fail. Demo runs on kind with Helm and shows JWT parsing: Alice (role guest) gets 403, no token returns 401, Bob (role admin) gets 200. Plugin requires no Kyverno admission controllers and enforces policies per-request in-mesh.
AI-written summary · about
chapters (12)
- 0:00Kyverno and Envoy integration
- 1:29Microservices security challenges
- 2:14Envoy proxy overview
- 2:54Kyverno Envoy plugin architecture
- 5:00Kyverno Envoy policy writing
- 7:56Demo setup prerequisites
- 10:06Istio installation and Kyverno plugin
- 14:08Deploying and testing services
- 17:30Kyverno Envoy with Envoy Gateway
- 22:25Envoy Gateway security policies
- 23:25Testing Envoy Gateway integration
- 25:05Q&A
related talks
05mKeynote: Envoy, the Engine for a Cloud Native Security Kernel
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
37mKyverno Introduction And Overview
42mBehold: A New Way to Deploy Pod Security Policies Using Kyverno!
31mKubernetes Native Policy Management with Kyverno!
35mShift-Left Policy Validation in Kubernetes With Kyvern...
46mKyverno: Compliance Inside Your Kubernetes Cluster
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring