Tutorial: Who Do You Think You Are? Driving the Need for Identity...
summary
Hands‑on tutorial shows how Istio, cert‑manager and SPIRE actually deliver and validate service identity: it configures cert‑manager + istio‑csr to replace Istio’s built‑in CA, issues a root CA secret, injects sidecars and uses Envoy SDS to stream short‑lived certs without restarts, flips PeerAuthentication to strict mTLS to block plain traffic, then applies an AuthorizationPolicy that denies all then allows only GET /headers from serviceAccount sleep. Finally it swaps to SPIRE SVID in SAN via a mounted socket and verifies issued identities work.
AI-written summary · about
chapters (13)
- 0:00Identity authentication basics
- 1:01Certificates auth and authorization
- 8:41SPIFFY and SPIRE overview
- 12:29SPIRE implementation deep dive
- 26:06Hands-on lab setup
- 27:55Installing cert-manager and Istio CSR
- 31:29External CA with cert-manager
- 35:22Istio with custom CA
- 37:07Certificate issuance testing
- 39:35Authentication policies
- 43:30Authorization enforcement
- 51:07SPIRE and Istio integration
- 1:04:20Conclusion and Q&A
related talks
19mIdentity, Istio, And You
32mIstio: Sailing to a Secure Services Mesh
28mService Identity - The Key to Zero Trust with Service Mesh
42mSecuring Kubernetes Workloads with Istio Service Mesh
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
32mA Platform-Agnostic Approach to Securing Workloads
30mIstio New Workload Identity Provision Pipeline Based on Envoy SDS
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified