Secure your Microservices with ZeroTrust approach
summary
Shows that zero trust enforces identity on every service call and can be added without changing app code by inserting Istio + Envoy sidecars into a Kubernetes cluster. Demo builds two Quarkus Java services, wires Keycloak JWT validation and Istio RequestAuthentication + AuthorizationPolicy, flips a configmap to registry-only external access, and proves calls fail until a valid token is supplied and only listed external hosts (e.g., google.com) are reachable. Cites 2021’s ~22 billion exposed records and >800 CVEs in 2022 as urgency.
AI-written summary · about
chapters (20)
- 0:00intro
- 0:27some numbers
- 0:55zero trust
- 1:05what can you expect?
- 1:33my goal for this presentation
- 2:15about jonathan
- 2:47about sonar
- 3:34the usual context... trust on perimeter
- 5:03trust on perimeter - the problem
- 8:11zta and how to approach the solution
- 10:07zta core principles
- 12:53zta challenges
- 14:16implementation
- 15:05one approach to zra wuthout touching apps code
- 15:28introducing istio service mesh
- 17:35how does istio work?
- 18:50demo
- 39:07conclusions
- 45:29references
- 45:43thank you
related talks
29mZero Trust for APIs: From Edge to Mesh with Istio
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
45mZero Trusting as a True Cloud Native Dev
35mDemystifying Zero-Trust for Cloud Native Technologies- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
31mTrust no one: implementing zero trust security with Ambient Service Mesh
19mKeynote: Demystifying Secure Application Communication with Zero Trust: Identity, Integri...