Zero Trust for APIs: From Edge to Mesh with Istio
summary
Shows how to enforce Zero Trust inside Kubernetes by running Istio ambient mode with its Z tunnel, CNI and optional waypoint proxy to get mTLS and JWT-based auth without changing app code. Demonstrates that ambient mode eliminates sidecar identity scraping, reduces lateral movement, and runs in production for ~2–3 years; layer‑4 adds ~2 ms per request in benchmarks; GA v1.31 shipped end of August. Examples include explicit service-to-service auth policies and eBPF‑based packet routing.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:53Traditional security problems
- 3:41Castle and moat limitations
- 6:10Ambient mesh overview
- 8:18Three pillars of zero trust
- 12:58Case study lateral movement
- 16:28Security boundaries reality
- 18:32Developer experience benefits
- 19:33Key takeaways and next steps
- 21:17Alternatives to service mesh
- 28:05Q&A session
related talks
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
31mTrust no one: implementing zero trust security with Ambient Service Mesh
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
22mIs Istio Ambient Mesh Secure?
38mEmbracing the Future: The Effortless Mutual TLS and Rich Layer 7 Authz Policy Without Sid...