Enforcing Automatic mTLS With Linkerd and OPA Gatekeeper
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 14:25· Room 31ABC - San Diego Convention Center, Upper Level·
summary
Shows Linkerd auto-injection turning an unencrypted emoji app into fully encrypted east‑west traffic observable as cleartext then gone under Wireshark, with proxies issuing CSRs bound to pod service accounts and auto‑rotating certs every 24 hours. Demonstrates OPA Gatekeeper installing a ConstraintTemplate and Constraint that detects missing Linkerd sidecars and required env vars, surfaces audit violations, and flips to compliant state after injection. Claims production scale (example: 3,500+ injected pods) and integrates audits and dry‑run policy rollout. zero-config automatic mTLS ConstraintTemplate + Constraint
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:31Outline
- 2:03Introductions
- 2:25What is mTLS
- 2:48How mTLS works
- 3:28Challenges with rolling mTLS
- 4:55Why use Linkerd
- 6:24What is Linkerd
- 6:44Demo
- 15:20Proxy identity
- 16:02When to inject proxies
- 17:09OPA Gatekeeper
- 17:51What is Gatekeeper
- 20:02Project Overview
- 22:16Demo Part 2
related talks
22mCompliance the Easy Way: Zero-conf mTLS for Dev and smooth Day-2 f...
35mEmissary + Linkerd: A Guide to End-to-end Encryption for your Cluster
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
34mZero to Secure: Using Open Service Mesh to Easily...
01h 12mHands-on Workshop: Zero Trust Networking in Practice with a Service M...
30mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
42mSecuring Kubernetes Workloads with Istio Service Mesh
38mImproving Secure Pod-to-Pod Communication Within Kubernetes Using...