What's a Zero-Trust Tunnel? SimpleOps and SecOps with Ambient Mesh
summary
Ambient Mesh replaces per-pod sidecars with a per-node DaemonSet z-tunnel that provides zero-trust tunnel behavior: app-to-zunnel traffic is unencrypted, z-tunnel-to-z-tunnel is mTLS, and each z-tunnel impersonates workload identity by requesting certificates from istiod. Layer‑7 policies run on a Waypoint proxy (Gateway API + Envoy). The z-tunnel moves from Envoy to a Rust proxy for lower CPU/memory use, supports rolling upgrades without redeploying apps, and scales by tuning the DaemonSet.
AI-written summary · about
chapters (14)
- 0:00Intro
- 2:15Marino Wijay
- 3:01Istio enables Zero-Trust Security
- 7:13How does Istio ambient work?
- 8:40How does it work (secure overlay only)?
- 9:32How does it work (secure overlay + L7)?
- 10:18Benefits
- 14:49How ztunnel gets certificates
- 16:44How communication is secured through waypoint proxy
- 18:46App compromise (ambient)
- 20:12Smaller exposure for secure overlay/ztunnel
- 21:11Node compromise (ambient)
- 22:35Recap
- 24:02Want to learn more?
related talks
37mWhat's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w...
31mTrust no one: implementing zero trust security with Ambient Service Mesh
29mZero Trust for APIs: From Edge to Mesh with Istio
22mIs Istio Ambient Mesh Secure?
23mIntroduction to Ambient Mesh
29mZero Trust Security with Service Mesh
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars