Bridging Trust Between Multi-Cluster Meshes

on YouTube ↗27m

" summary

Hands-on recipe for cross-cluster identity: a Terraform-built demo with two EKS clusters, Istio installed via Helm, and SPIRE issuing SPIFFE X.509 identities while SPIRE as intermediate CA delegates to the cluster root CA (cert-manager/ACM PCA). The setup exchanges trust bundles, validates East‑West calls, then cuts East‑West and routes traffic through the Ingress Gateway to a virtual service, proving a one-way trust bundle and workable multi‑mesh federation.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 3:15Multi-cluster complexity
3. 7:24Securing trust domains
4. 10:54Universal trust with SPIRE
5. 15:24Demo setup overview
6. 22:53Live multi-cluster demo
7. 26:47Q&A

" related talks

• 31mBridging Mesh Enclaves: Securing and Maintaining Mesh HeterogeneityLukonde Mwila · CloudNativeSecurityCon North America 2024
• 29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster AuthenticationAndrew Harding · KubeCon + CloudNativeCon North America 2021
• 32mSecuring Communication Between Meshes and Beyond with SPIFFE FederationEvan Gilman, Oliver Liu · KubeCon + CloudNativeCon North America 2019
• 30mHow SPIFFE Helps Istio in Service Mesh FederationYonggang Liu, Wencheng Lu · KubeCon + CloudNativeCon China 2019
• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud ScenariosMatt Turner · Istio Day Europe 2023
• 30mHow SPIFFE Helps Istio in Service Mesh FederationYonggang Liu, Wencheng Lu · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 05mBest Practices on Setting up Multi Cluster Service Mesh in AWSVictor Yang · DevOpsDays Seattle 2024