⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios

on YouTube ↗07m

" summary

Istio uses SPIFFE SVIDs as x509 certs and Envoy fetches them via SDS; replacing istioD’s CA with SPIRE lets each mesh run one SPIRE server per cluster and federate trust bundles so workloads across hybrid clouds trust each other without a single universal key. The setup forwards SDS requests from istio-agent to a SPIRE agent over the Unix socket, issues workload-attested SVIDs, and enables end-to-end mTLS and global identity-based policy control, even across thousands of clusters (people run ~2000 K8s clusters).

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 0:48What is Spiffy
3. 1:35What is Istio
4. 2:18Default Istio
5. 2:38Multiple Meshes
6. 3:33SPIRE
7. 5:31Summary

" related talks

• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 32mSecuring Communication Between Meshes and Beyond with SPIFFE FederationEvan Gilman, Oliver Liu · KubeCon + CloudNativeCon North America 2019
• 30mHow SPIFFE Helps Istio in Service Mesh FederationYonggang Liu, Wencheng Lu · KubeCon + CloudNativeCon China 2019
• 29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster AuthenticationAndrew Harding · KubeCon + CloudNativeCon North America 2021
• 31mBridging Mesh Enclaves: Securing and Maintaining Mesh HeterogeneityLukonde Mwila · CloudNativeSecurityCon North America 2024
• 30mHow SPIFFE Helps Istio in Service Mesh FederationYonggang Liu, Wencheng Lu · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 27mBridging Trust Between Multi-Cluster MeshesLukonde Mwila, Ovidiu Valeanu · Istio Day North America 2023
• 32mA Platform-Agnostic Approach to Securing WorkloadsLukonde Mwila · EnvoyCon 2023