Red Light, Green Light: Traffic Security in the Service Mesh with Istio
Talkat Istio Day Europe 2023 · on Tuesday, 2023-04-18· at 15:20· Hall 7, Room D | Ground Floor | Europe Complex·
summary
Bloomberg shows a working set of controls: Istio ingress gateway adds request IDs and exposes X-Envoy headers so teams trace per-request latency with no app changes; egress uses Kubernetes NetworkPolicy + Istio egress gateway, ServiceEntry, mTLS and Open Policy Agent for reviewable, layered allowlists. Integration with SPIFFE/SPIRE is planned for workload identities. Deployed across ~30 clusters (75–200 nodes each) serving 1,000+ users and 2,000+ apps, the approach moves from “deny all” to audited, minimal outbound access.
AI-written summary · about
chapters (8)
- 0:00Start
- 14:20Bloomberg Platform as a Service
- 15:36Egress Current Limitation
- 18:51Solution?
- 19:16Requirements for the Solution
- 20:11Istio-based Solution
- 20:27Solution - Kubernetes L3/L4
- 22:11New Security Model
related talks
32mIstio: Sailing to a Secure Services Mesh
32mIstio: Weaving the Service Mesh [I]
48mIstio An open platform to connect, manage, and secure microservices
26mService Mesh Journey - Building Security and Reliability One Si...
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
06mWhat's New in Istio?
42mSecuring Kubernetes Workloads with Istio Service Mesh
42mIstio: Weaving, Securing and Observing microservices