How Yelp Moved Security From the App to the Mesh with Envoy and OPA
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 10:55· Room 6F - San Diego Convention Center, Upper Level·
summary
Yelp replaces app-level auth with a host-side mesh using Envoy for mTLS and JWT-based authn and OPA for authz, protecting hundreds of services serving >100M monthly users. Engineering builds an OPA policy manager that transpiles legacy rules to Rego, bundles them to S3, and runs one OPA per host alongside Envoy, with decision logs shipped to Splunk. Result: deny-by-default authorization across the mesh with minimal developer changes.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:05Yelp's Mission
- 3:44Walled Garden Approach
- 7:03Authentication Requirements
- 8:28Yelp's Service Mesh ca. 2017
- 11:00Service AuthN - Service Mesh
- 13:46Human Authentication - Library
- 14:49Human Authentication - Service Mesh
- 16:04Authentication Summary
- 18:32Authorization - Application
- 19:29Custom Policy Language - Scope .
- 20:57Authorization Requirements
- 22:49Authorization - Service Mesh
- 26:15OPA Policy Manager
- 29:11Authorization + Authentication
- 30:09Authorization Results Dashboard
- 30:35Future Ideas - Service Mesh
- 32:18Future Ideas - Other Use Cases
- 33:30Key Takeaways
related talks
45mService Mesh Security: Shifting Focus to the Application Layer
26mFine-Grained User Authorization for Kubernetes with OPA and LDAP
23mAuthentication and Authorization in Micro Services
17mSecurity and Flexibility: Decouple Policy to Enable Architectural Choice
36mAdvanced Authentication patterns at the Edge
28mAuthorization with Envoy
36mDynamic and Context-Aware Security Policies for the Cloud Using...
25mMake Your Security Policy Auditable