Istio: Sailing to a Secure Services Mesh
summary
Istio wires Envoy sidecars into each pod to provide mutual TLS using an Istio CA that mints SPIFFE IDs and mounts certificates, while Mixer enforces authorization and streams telemetry. Live demo shows an attacker reading Kubernetes secrets, using stolen certs to change a database balance, then Calico network+service-account policies block those lateral moves and return 403s. Roadmap items include SNI for ingress, incremental mTLS enablement, RBAC/OPA policy, multi-cluster identities, user JWTs and external CAs.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:19The problem
- 2:45Why Istio
- 4:11Istio Architecture
- 8:55Ingress Service
- 9:39Authorization
- 11:57Egress Policy
- 13:20Demonstration
- 13:55Demo
- 23:48Security Policy
related talks
42mSecuring Kubernetes Workloads with Istio Service Mesh
48mSecuring Kubernetes with Istio
48mIstio An open platform to connect, manage, and secure microservices
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
42mIstio: Weaving, Securing and Observing microservices
18mIstio for Controls Compliance- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars