Service Mesh Security in a Nutshell
summary
Concrete patterns for ingress, east‑west, and egress security: provision certificates and use mTLS at ingress or TLS passthrough with SNI routing; validate JWTs via external identity providers; migrate workloads using permissive to strict mTLS; enforce workload RBAC using service accounts, namespaces or IPs; originate TLS or mTLS origination at egress to encrypt outbound traffic; extend Envoy/Istio with WebAssembly sidecar extensions for custom authN/authZ and runtime policy enforcement; multi‑cluster options are gateway mutual auth or service mutual auth with shared CA.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:13A Simple System
- 0:55Ingress Gateway Patterns
- 3:05Mesh Workload Patterns
- 6:05Egress Gateway Patterns
- 8:15Multi-Cluster Patterns
- 8:59Advanced Patterns
related talks
32mIstio: Sailing to a Secure Services Mesh
34mZero to Secure: Using Open Service Mesh to Easily...
28mService Identity - The Key to Zero Trust with Service Mesh
23mAuthentication and Authorization in Micro Services
42mSecuring Kubernetes Workloads with Istio Service Mesh
33mCNI or Service Mesh? Comparing Security Policies Across Providers
26mService Mesh Journey - Building Security and Reliability One Si...
53mDo you need a Service Mesh?