CNI or Service Mesh? Comparing Security Policies Across Providers
summary
Compares CNI plugins (Calico, Cilium) and service meshes (Istio, Linkerd, Envoy) by concrete enforcement points and failures: kernel-level eBPF or iptables enforce L3/L4 policies but have race window on pod churn, sidecar mTLS enforces identity at L7 but trusts any holder of a stolen service account token to mint client certs. Shows Istio ambient (node ztunnel) and Cilium service-mesh directions, demos certificate theft working, and recommends defense-in-depth.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:39What we'll cover...
- 1:58What kind of changes?
- 2:26What is a CNI plugin?
- 2:50Calico plugin
- 3:05weave plugin
- 3:19cilium plugin
- 3:55What is a Service Mesh?
- 6:10service mesh with bridge plugin
- 9:01CNI - contrived scenario
- 10:15Svc Mesh - what is enforceable?
- 11:01Svc Mesh - how is it enforced?
- 14:03Svc Mesh - contrived scenario
- 14:57#1. Right wizard tool, right job.
- 15:50#2. Evolution.
- 16:06The landscape is changing
- 16:38Ambient Mesh
- 19:02Cilium Service Mesh
- 20:35Takeaways
related talks
05mUnlocking Next-Gen Networking and Security with Cilium Service Mesh
32mIstio: Sailing to a Secure Services Mesh
43mA Guided Tour of Cilium Service Mesh
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
10mService Mesh Security in a Nutshell
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
28mService Identity - The Key to Zero Trust with Service Mesh
31mFrom CNI to Service Mesh: Demystifying Kubernetes Networking