The Security Evolution of GRPC Services in the Mesh
summary
Shows concrete changes: Istio supports three gRPC east‑west options — gRPC xDS proxy (app links directly to Istio control plane), Z Tunnel (ambient L4 overlay) and traditional Envoy sidecar — and verifies authn/authz via SPIRE mTLS and authorization CRD selectors that filter by SPIFFE ID and gRPC method (POST /DummyServerStream). Measured latencies on a local cluster: sidecar ~0.88 ms average, Z Tunnel ~300 µs median (~180 µs avg), gRPC xDS ~108 µs avg. Demo installs Istio ambient, deploys client/server, and shows policies allow/deny as expected using mTLS via SPIRE and Waypoint.
AI-written summary · about
chapters (8)
- 0:00GRPC security in service mesh
- 1:51Zero trust and service mesh
- 7:54Service identity with SPIFFE/SPIRE
- 13:41GRPC in Istio mesh
- 18:08Auth in ambient mesh
- 20:35Demo: ambient mesh policies
- 24:50GRPC performance comparison
- 27:45Choosing GRPC security model
related talks
22mThe Security Evolution of gRPC Services in the Mesh - Amim Knabben, VMware
29mgRPC load balancing and Service Mesh
18mHigh Performance Service Meshes with gRPC Proxyless
28mRed Light, Green Light: Traffic Security in the Service Mesh with Istio
31mAuthentication and Security in gRPC Microservices
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
32mIstio: Weaving the Service Mesh [I]
31mBridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity