Lightning Talk: Enhancing Security with Istio: Realtime JWT Access Revocation
summary
Claims a working system that revokes tokens across clusters within seconds by streaming Auth0 events to an events hub, fan‑out to a lightweight revocation service in each cluster, and an Istio external authorization policy that consults a per-cluster in‑memory denylist. Uses Istio RequestAuthentication + AuthorizationPolicy (custom external) and Helm for rollout, keeps original JWT validation, requires no app changes, and the demo shows deny/unblock cycles completing in seconds.
AI-written summary · about
chapters (9)
- 0:00JWT and Istio security
- 1:47Challenge of revoking JWT tokens
- 3:58App teams struggle with revocation
- 4:40Revocation with Istio authorization
- 6:25Implementing revocation service
- 8:08Real-time revocation across clusters
- 9:30Continuous access evaluation
- 10:13Key considerations and limits
- 10:56Live demo: real-time JWT revocation
related talks
07mLightning Talk: Running Arbitrary Code Safely with Istio
05mLightning Talk: How We Use Istio and OPA for Authorization
05mLightning Talk: How We Use Istio and OPA for Authorization
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
32mIstio: Sailing to a Secure Services Mesh
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
11mLightning Talk: How to deploy mutually authenticated TLS without ruining everything
10m⚡Lightning Talk: Securing AI Agents: Applying Service Mesh Patterns To MCP