AuthN and AuthZ at Cruise: Crawl, Walk, Run
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 11:55· Room 408 AB + Online·
summary
Cruise has ~2,000 employees (≈1,500 engineers) and ~150 services mostly on Kubernetes, originally using HashiCorp Vault and a cloud IdP. Early stage uses a SAML authenticating proxy sidecar that leads to bypass headers and auth sprawl. The middle stage standardizes on OIDC and a custom entitlement broker that mints JWTs, plus libraries and self‑service onboarding. The current approach moves ingress from nginx to Envoy external authorization via Istio, uses OPA with Rego bundles pulled per‑app for coarse‑grained auth, enables mTLS between sidecars, and enforces auth by default.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:10Three types of callers
- 1:29Crawl Walk Run
- 2:22The Bad Old Days
- 3:14The Crawl Phase
- 3:43SAML Flow
- 5:26Request Driven
- 5:56Walk
- 11:18Walk Stage
- 15:11Run Stage
- 17:10External Authorization
- 19:11Open Policy Agent
- 22:09Bundle API
- 23:30What we did
- 23:43Moving from Nginx to Envoy
- 26:18Authentication
- 27:32Stateless Authorization
- 28:33Fine Grain Authorization
- 28:56New UI
- 29:29All services have auth
- 30:56Transparent TLS between services
- 33:41Join us
- 33:54Questions
related talks
26mOne Auth Gateway to authenticate them all
36mAdvanced Authentication patterns at the Edge
27mFrom AuthN to AuthZ: The Future of Identity
28mAuthorization with Envoy
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
09mNavigating the Identity Abyss in the AI‑Native Era
28mBuilding Identity for an Open Perimeter
30mArmy of Proxies! How Netflix scales identity based zero trust...