Bridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity
summary
Demonstration shows a working bridge using SPIFFE/SPIRE to issue interoperable identities (X.509 or SVIDs) to Envoy sidecars and a custom Envoy mesh, with a single Spire server as root CA distributing certificates via the Workload API and SDS. Istio runs in strict mTLS mode; Envoy clusters accept specific SPIFFE IDs across namespaces. Demo forwards requests from an edge proxy in one mesh to products in the Istio mesh and returns Istio’s product list, proving cross-mesh trust and encryption.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:52Microservices complexity
- 3:15Security standards challenges
- 5:45Service meshes for trust
- 7:32Bridging heterogeneous meshes
- 9:17Universal identity analogy
- 10:19SPIFFY and SPIRE standards
- 12:04Unifying trust with identities
- 13:26SPIFFY vs SPIRE
- 15:16Demo setup
- 19:52Cross-mesh communication demo
- 27:20Q&A
related talks
32mSecuring Communication Between Meshes and Beyond with SPIFFE Federation
27mBridging Trust Between Multi-Cluster Meshes
30mHow SPIFFE Helps Istio in Service Mesh Federation
30mHow SPIFFE Helps Istio in Service Mesh Federation
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
32mA Platform-Agnostic Approach to Securing Workloads
49mReal World SPIFFE Scenarios and Outcomes