The Security Evolution of gRPC Services in the Mesh - Amim Knabben, VMware
summary
Istio is shown enforcing mTLS via SPIFFE IDs and delivering identity, authn/authz and auditing via CRDs and Envoy XDS; tests on kind with provided makefiles report latency: traditional sidecar ~1.9 ms at 1,000 RPS, ambient ztunnel ~300 µs, and proxyless client ~200 µs. Ambient mode routes node traffic through a zTunnel layer 4 Rust daemon (no L7 filtering), while L7 rules run at a waypoint Envoy or proxyless gRPC in‑app XDS; proxyless is faster but still experimental in Istio.
AI-written summary · about
chapters (8)
- 0:00gRPC security intro
- 1:26Zero trust in mesh
- 6:39SPIFFE identity basics
- 9:49gRPC security evolution
- 13:46Live demo: auth policies
- 16:46Security model performance
- 18:32Choosing gRPC security
- 19:41Q&A on SPIFFE
related talks
29mThe Security Evolution of GRPC Services in the Mesh
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
32mIstio: Weaving the Service Mesh [I]
31mAuthentication and Security in gRPC Microservices
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
28mRed Light, Green Light: Traffic Security in the Service Mesh with Istio
29mZero Trust for APIs: From Edge to Mesh with Istio
32mIstio: Sailing to a Secure Services Mesh