How the CF Service Mesh Could Solve Identity and Access...
summary
Cloud Foundry integrates Envoy sidecars with the Istio control plane to push codeless, language-agnostic IAM policies from a central control plane, using UAA/Pivotal SSO for OpenID Connect flows, mutual TLS for channel security, and token/claim checks at the proxy. The demo applies an authentication policy to the Bookinfo app and enforces login immediately; the mesh also distributes certificates and telemetry. Work is upstream in Istio security WG and an Istio proposal; enterprises drove requirements via interviews.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:04Challenges of security
- 1:45The changing security landscape
- 2:24The near past landscape
- 3:21The near past challenges
- 5:47What is Istio and the Service Mesh
- 14:12What are we doing?
- 21:25Our learnings
- 22:40Help us in Open Source
related talks
39mCloud Foundry UAA as an Identity Gateway
28mIdentity: From Legacy to Microservices
32mIstio: Sailing to a Secure Services Mesh
32mIstio: Weaving the Service Mesh [I]
18mIstio for Controls Compliance
28mService Identity - The Key to Zero Trust with Service Mesh
10mService Mesh Security in a Nutshell
30mAdding Sidecars to Cloud Foundry - Gabriel Rosenhouse & Angela Chin