Securing Cloud Native Communication, From End User to Service
summary
Conference demonstrates concrete setup: Ambassador + Consul Connect configures Envoy proxies to enforce mTLS between edge and services and uses SMI intentions as service policies. Demo shows CloudFlare TLS to Ambassador, Ambassador issuing mTLS to upstream Envoy sidecars, giving end-to-end encrypted, authenticated calls; live demo has connectivity hiccups but configuration and metrics (request counts, latencies) appear and policy moves services from denied to allowed. Cites breach costs ~$3.86M and a 72% year‑over‑year rise to justify minding TLS gaps.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:00So, we don't want to scare you, but...
- 6:51Exploring end-to-end communication
- 8:33API Gateway: Edge proxy, ingress, ADC...
- 9:33Service Mesh: Proxy mesh, Fabric model...
- 10:23Service Mesh: Three Pillars
- 12:16Bypass the perimeter by attacking services
- 13:31Network segmentation
- 14:43Problem: Dynamic environments...
- 15:09Network / Service segmentation with intention-based security
- 16:43Control planes and data planes
- 17:32Control planes: Differing use cases
related talks
38mModern Service Networking With Consul Connect, Envoy and Kubernetes
11mLightning Talk: How to deploy mutually authenticated TLS without ruining everything
34mZero to Secure: Using Open Service Mesh to Easily...
29mDebugging Envoy Tunnels: A Deep Dive
10mService Mesh Security in a Nutshell
06mLightning Talk: Securing Your Systems with Service Mesh
05mLightning Talk: Speak Egress and Exit: A Look at Securing Traf...
23mHow to Secure Microservices Without Traditional Firewall