Sleep Better at Night: Dapr's Approach to Secure Cloud Native Development
Talkat AppDeveloperCon Europe 2024 · on Tuesday, 2024-03-19· at 13:30· Pavilion 7 | Level 7.3 | Room S04·
summary
Dapr gives each app a SPIFFE identity with per-replica keys and enforces mTLS by default so service calls carry cryptographic attestation; demo uses Java apps calling local sidecar on Kubernetes, showing 200/204 success for allowed invoke and publish, and explicit “permission denied” / “pubsub not found” or “forbidden” errors for blocked calls. YAML policies and component scoping restrict which sidecars load Kafka/postgres components and which topics or HTTP verbs each service may use.
AI-written summary · about
chapters (11)
- 0:00Zero trust security intro
- 2:25Why zero trust matters
- 3:49Zero trust challenges
- 5:55Dapr and security features
- 7:00Dapr identity with SPIFFE IDs
- 9:49Service invocation demo
- 14:45Infrastructure access components
- 16:54Securing pub/sub
- 19:23Pub/sub demo with policies
- 24:40How Dapr improves zero trust security posture
- 25:01Q&A
related talks
29mRunning Dapr in Production
35mCloud Native Security for the Rest of Us
31mSecure-by-Default Spring Apps: Zero Trust, OAuth2, and Runtime Policies
41mCloud Native Security For The Rest Of Us
23mCloud Native Security for the Rest of Us
56mThe Future of AppSec is Cloud-Native
38mImproving Secure Pod-to-Pod Communication Within Kubernetes Using...
41mPanel: Securing Cloud Native Applications