Securing Web Apps in Kubernetes Using Spring Authorization Server
summary
Integration of Spring Authorization Server with Kubernetes that shows an actual implementation: key rotation with k8s Secrets using an Informer to populate a JWK source and select the active key, a demo on kind+tilt that rotates signing keys and verifies new JWT kids, and a Kubernetes-backed RegisteredClient repository. Demonstrates the VMware Tanzu Application Platform AppSSO flow where an AppSSO-managed AuthServer and ClientRegistration resources create client_id/client_secret, bind them into workloads via Spring Cloud Bindings, and return usable tokens.
AI-written summary · about
chapters (14)
- 0:00Introduction and speakers
- 1:49Audience familiarity check
- 2:10Agenda and demo overview
- 3:13Key rotation use case demo setup
- 7:29In-memory key repository implementation
- 10:23Kubernetes key repository implementation
- 15:25Customizing SSO experience with Spring
- 18:37Tanzu Application Platform overview
- 21:50Auth server configuration details
- 23:12Client registration in Kubernetes
- 26:23Obtaining tokens and secrets
- 27:26Service binding and developer workflow
- 31:17Live demo on Tanzu platform
- 33:23Resources and next steps
related talks
54mHow to secure your Spring apps with Keycloak
01h 30mSecuring Microservices with Spring Cloud Security
01h 02mGetting Started with Spring Authorization Server
34mBullet proof Microservices with Kubernetes and Spring
51mEnterprise Security with Spring Authorization Server 1.0
49mSpring Cloud on Kubernetes
31mSecure-by-Default Spring Apps: Zero Trust, OAuth2, and Runtime Policies
54mHow to secure your Spring Apps with Keycloak