Using Keycloak Authorization Service for Kubernetes Service-to-Service…

on YouTube ↗16m

" summary

Shows a working WebAssembly Wasm plugin that makes Istio act as a Policy Enforcement Point and calls Keycloak as a Policy Decision Point, using Istio Ambient mode and the UMA ticket grant flow. Demo runs live requests, measures latencies (8.8 ms then ~2 ms end-to-end), returns 403 for denied POSTs and 401 for missing tokens, blocks direct pod port-forwarding, and fails closed when Keycloak is down; code and telemetry (OpenTelemetry) are on GitHub.

AI-written summary · about

" chapters (11)

1. 0:00Keycloak overview
2. 1:04Service-to-service auth
3. 2:29Istio ambient model
4. 3:10Orders endpoint scopes
5. 4:57Keycloak decision flow
6. 7:49Prerequisites setup
7. 9:40Demo setup
8. 11:30Successful auth telemetry
9. 12:34Denied requests latency
10. 13:16Missing tokens handling
11. 14:40Keycloak failure impact

" related talks

• 32mIstio: Sailing to a Secure Services MeshSpike Curtis, Dan Berg · KubeCon + CloudNativeCon North America 2017
• 56mDistributed Authorization for Microservices Powered by Kubernetes, Istio and Open Policy AgentGong Mengnan · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 42mSecuring Kubernetes Workloads with Istio Service MeshGufran Mirza · Conf42 DevSecOps 2023
• 58mUsing Service Meshes and Kubernetes to Solve Service-to-Service Communications...Ben Hall · NDC Porto 2019
• 46mIstio and API Management Integration with Envoy WeAssembly ExtensionsSalya Jayanti · apidays Paris 2021
• 36mAdvanced Authentication patterns at the EdgeDenis Jannot · DevOpsDays Geneva 2022
• 52mEmpower Your Microservices with Istio Service MeshHossam Barakat · NDC Oslo 2019
• 55mEmpower Your Microservices with Istio Service MeshHossam Barakat · NDC Sydney 2019