Demystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
summary
Demonstrates that mutual TLS provides identity, confidentiality and integrity and that Istio ambient mesh can deliver mTLS without sidecars by simply label the namespace, no app restarts required. Uses K3s, Istio ambient (zTunnel), SPIFFE identities, flannel CNI and a Node.js client/server; shows manual OpenSSL-based mTLS is cumbersome and risky, then enrolls the namespace to ambient and observes automatic certificates, metrics and Kiali visualizations. Adds a global deny-all and then allows specific traffic with a waypoint for L7 policies — the live demo works.
AI-written summary · about
chapters (12)
- 0:00Zero Trust and Istio Ambient intro
- 3:36Secure communication matters
- 7:51Mutual TLS core principles
- 9:55Demo setup and cluster overview
- 13:55Client-server in Kubernetes
- 14:57Manual Mutual TLS the hard way
- 21:38Enable Istio Ambient for auto mTLS
- 23:45Verify mTLS with metrics
- 26:57Deny-all zero trust policies
- 29:28Layer 4 auth policies
- 31:35Layer 7 auth with Waypoints
- 35:31Summary and resources
related talks
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
19mKeynote: Demystifying Secure Application Communication with Zero Trust: Identity, Integri...
29mZero Trust for APIs: From Edge to Mesh with Istio
31mTrust no one: implementing zero trust security with Ambient Service Mesh
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
30mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...