gRPC Proxyless Service Mesh with Security
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 11:00· Room 501 ABC + Online·
summary
Adds mTLS for xDS-managed gRPC by wiring Traffic Director (xDS) security configs to gRPC channels and servers, and shipping a certificate provider plugin framework plus a file-watcher plugin that reads certs from disk. Implementation in Go, C++, Java and Python supports xDS-supplied filter chains, cert IDs, and server authorization, uses GKE + Google CAS for cert minting, and exposes xds channel/server credentials with a TLS fallback. Supports dynamic certificate rotation without app restarts and is in public preview on Google Cloud.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:16Agenda
- 1:34Service Mesh
- 3:21XDS
- 4:18GRPC
- 5:08Proxima Service Mesh
- 6:10Security in Service Mesh
- 7:56Service Identity
- 8:56Certificate Management
- 10:16Transport Security
- 11:03How does it all work
- 12:10Representation of how it works
- 13:33More technical details
- 16:50GRPC RFC
- 17:58Certificate Provider Plugin
- 20:04Certificate Provider Framework
- 21:11gRPC Library
- 22:14Service Identities
- 26:24deployment and testing
- 27:21diagram
- 28:46road map
- 30:45resources
- 31:24Questions
related talks
20mProxyless Service Mesh with gRPC
23mA Simplified Service Mesh With gRPC
16mxDS in gRPC for Service Mesh
23mHow Proxyless gRPC Works in a Service Mesh
33mgRPC For Microservices: Service-mesh and Observability
46mProxyless Service Mesh for gRPC Java Services
23mxDS Support in gRPC
25mAdapting Our XDS Control Plane for Proxyless gRPC