Embracing the Future: The Effortless Mutual TLS and Rich Layer 7 Authz Policy Without Sid...
summary
Istio implements a two-layer, sidecar-less mesh: a per-node zero-trust tunnel daemonset that handles layer‑4 mTLS and TCP routing, plus an Envoy-based waypoint proxy (Gateway API) that enforces rich layer‑7 authz. Namespace labeling enrolls pods without restarts. Live demo shows mutual TLS and deny/allow policies taking effect, with layer‑7 checks blocked until a waypoint is deployed. Early user reports a ~20% reduction in Kubernetes node size; ambient reaches beta in May and aims for GA later this year.
AI-written summary · about
chapters (11)
- 0:00Talk introduction
- 5:22Sidecar challenges
- 8:11Ambient mesh goals
- 13:14Cost benefits
- 17:50Security advantages
- 19:12Demo setup
- 22:24Enabling ambient mode
- 25:37Zero-trust policies
- 28:26Layer 7 with Waypoint
- 34:12Demo recap
- 35:06Q&A on multi-cluster mutual TLS
related talks
30mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
29mZero Trust for APIs: From Edge to Mesh with Istio
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...
31mTrust no one: implementing zero trust security with Ambient Service Mesh