Zero-Trust Networks: Identity, AuthN, AuthZ, Audit
summary
Zero-trust networking requires per-workload cryptographic identity, short-lived certificates and auditable authZ decisions rather than a trusted perimeter. Uses the SPIFFE spec with SPIRE 0.8 or Istio Citadel (Istio 1.1 adds SDS/node agents) to mint x.509 or JWT identities, Envoy sidecars perform mutual TLS via Envoy and mTLS authentication, and Calico enforces policies at pod and host via Felix. A live demo creates three service-account-based policies with Calico network policies and successfully blocks curl attacks after deployment of SPIFFE identities.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 1:21Context of zero trust security
- 3:04Identity authentication authorization audit
- 7:28SPIFFY identity specification
- 12:44Istio service mesh identity
- 15:56SPIRE implementation details
- 19:51Service account best practices
- 22:19Calico unified policy model
- 27:47Live demo of policy enforcement
- 33:43Audit and compliance features
- 35:28Key takeaways and next steps
- 37:13Q&A and community resources
related talks
35mDemystifying Zero-Trust for Cloud Native Technologies
39mOn Establish a Production Zero Trust Architecture
40mZero Trust Service Mesh with Calico, SPIRE, and Envoy
26mA DevSecOps Approach to Zero Trust Network Security
23mThe Long and Windy Road that leads to Cloud Native Security
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
06mZero Trust: Security Without Boundaries
36mSecuring Agentic Platforms with Zero-Trust Workload Identities