Emissary + Linkerd: A Guide to End-to-end Encryption for your Cluster
summary
Demo shows Emissary (Envoy) terminating TLS at the edge and Linkerd adding in-cluster mTLS so browser-to-pod encryption is continuous, using a Let's Encrypt cert in a K8s secret for north-south and Linkerd identity for east-west. Installation uses Helm for Emissary and linkerd CLI; injecting Linkerd is one annotation linkerd.io/proxy-inject: enabled which spawns a sidecar per pod. The Emojivoto app works end-to-end, tap output proves requests are TLS and performance overhead is tiny. Per-pod mTLS with 24h workload certs
AI-written summary · about
chapters (10)
- 0:00Start
- 0:51Jason Morgan
- 4:12Application Security
- 10:24Demo
- 11:50Install the Emissary Crds
- 14:14Tls
- 14:52Configure Emissary
- 20:20Destination Controller
- 21:29Visualization Components
- 32:53Ebpf
related talks
37mEnforcing Automatic mTLS With Linkerd and OPA Gatekeeper
22mCompliance the Easy Way: Zero-conf mTLS for Dev and smooth Day-2 f...
34mZero to Secure: Using Open Service Mesh to Easily...
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
38mImproving Secure Pod-to-Pod Communication Within Kubernetes Using...
05mLightning Talk: Speak Egress and Exit: A Look at Securing Traf...
32mAchieving Mutual TLS: Secure Pod-to-Pod Communication Without the Hassle
37mSecuring Cloud Native Communication, From End User to Service