Lightning Talk: Speak Egress and Exit: A Look at Securing Traf...
summary
A live demo builds Istio CRs—ServiceEntry, Gateway, VirtualService, DestinationRule—and shows a curl pod first getting a 502, then a 200 once the ServiceEntry is applied. Routing shifts from sidecar TLS origination to an egress gateway (metadata ID changes), then to egress gateway TLS origination on port 443, and finally to mTLS between sidecar and egress with an X‑Forwarded‑Client‑Cert header observed. Envoy configuration is inspected to confirm the changes and all scenarios work end‑to‑end.
AI-written summary · about
related talks
11mLightning Talk: How to deploy mutually authenticated TLS without ruining everything
07mLightning Talk: Running Arbitrary Code Safely with Istio
32mIstio: Sailing to a Secure Services Mesh
42mSecuring Kubernetes Workloads with Istio Service Mesh
10mBest-Practices for Securing Egress Traffic with Istio
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
28mRed Light, Green Light: Traffic Security in the Service Mesh with Istio
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars