Best-Practices for Securing Egress Traffic with Istio
summary
Shows a concrete AKS setup: Istio installed with registry-only outbound policy, an egress gateway on a dedicated egress node pool, Azure Firewall rules permitting only egress node IPs, and Kubernetes NetworkPolicies applied per namespace (three namespaces in the demo). Gateway performs TLS origination, Envoy access logs flow to Log Analytics, and the demo repo contains Helm/manifest examples that reproduce the configuration and prove that only pods on egress nodes can reach external hosts.
AI-written summary · about
chapters (5)
- 0:00Securing egress with Istio
- 1:25Integrating security tools
- 3:50Encrypting outbound traffic
- 5:15Demo setup and config
- 9:08Advanced lockdown resources
related talks
31m(Almost) Secure by Default - Next Steps for Hardening Istio in Production...
41mEffortless Secure and Control Traffic Using Kubernetes Gateway API for Ingress, Egress an...
05mLightning Talk: Speak Egress and Exit: A Look at Securing Traf...
42mSecuring Kubernetes Workloads with Istio Service Mesh
37mReinventing Networking: A Deep Dive into Istio's Multicluster Gateways
28mRed Light, Green Light: Traffic Security in the Service Mesh with Istio
28mIstio in Action: Taking Kubernetes Traffic Control to the Next Level
42mAmbient Mesh: new sidecar less & faster Istio for zero trust