Service Mesh Security: Shifting Focus to the Application Layer
summary
Yelp abandons mesh‑level enforcement and implements app‑layer auth: services use JWTs for short‑lived identities, authorization via OPA running in ECS Fargate, and client middleware plus auto‑generated libs and a curl wrapper. Built-in caching yields 99% cache hits and <5 ms added latency at the 95th percentile. Deployment works and sees broad opt‑in with zero system incidents so far, but migration costs persist — hundreds of clients must upgrade libraries, creating the main operational headache.
AI-written summary · about
chapters (15)
- 0:00Introduction and background
- 3:10Service mesh basics and early attempts
- 8:03Infrastructure migration and Envoy adoption
- 10:52Challenges with infrastructure-based security
- 13:22Shifting focus to application layer security
- 14:44Core security requirements and architecture
- 17:33Authentication with JWTs
- 22:06Authorization with Open Policy Agent
- 27:03Performance optimizations and caching
- 28:28Observability and monitoring
- 31:38Operational excellence and reliability
- 33:23Challenges and trade-offs of application layer
- 36:35Results and security posture improvements
- 38:03Key takeaways and final thoughts
- 40:53Recap of the journey and Q&A
related talks
40mHow Yelp Moved Security From the App to the Mesh with Envoy and OPA
10mService Mesh Security in a Nutshell
44mService Mesh - The New Single Point of Failure
53mService Mesh: What, Why, And How?
43mService Mesh and the future of networking
40mReimagining Application Networking and Security
53mDo you need a Service Mesh?
11mWelcome & Opening Remarks