Zero Trust Security with Service Mesh
summary
Zero trust implemented with the open‑source Kuma control plane (now in CNCF sandbox) issues certificates via a built‑in CA, programs sidecar proxies using Envoy, and enables mTLS automatically. A single deny‑all policy blocks cross‑service traffic, then granular allow rules use SANs in certs and OPA-style checks for tokens. Multi‑zone/global control plane manages meshes across data centers, certificates auto‑rotate, and metrics export to Prometheus/Grafana; a pre‑recorded demo shows preventing dev containers from reaching production.
AI-written summary · about
chapters (8)
- 0:00Introduction to Zero Trust
- 2:42Four pillars of Zero Trust
- 7:37Identity challenges in microservices
- 13:56What is a service mesh
- 16:21Kuma universal service mesh
- 20:55Automating security with policies
- 23:47Observability in Zero Trust
- 26:39Demo and resources
related talks
25mHow to Achieve Zero-Trust Security With Kuma Service Mesh
31mTrust no one: implementing zero trust security with Ambient Service Mesh
12mService Mesh In Action With Kuma: Security, Routing, and Observability
26mA DevSecOps Approach to Zero Trust Network Security
35mDemystifying Zero-Trust for Cloud Native Technologies
45mZero Trusting as a True Cloud Native Dev
01h 02mIntroduction to Zero Trust Security
29mZero Trust for APIs: From Edge to Mesh with Istio