Administering Multi Cluster Service Meshes Securely
summary
Explains that copying kubeconfigs creates n squared connections and exposes cluster API credentials, then proposes a management-cluster server with remote agents that pull config using an xDS-style stream. Uses a bootstrap token and TLS bootstrapping to exchange identity and issue mTLS certs per agent, eliminating the need to share kubeconfigs, reducing API server load, and easing GitOps. Demo deploys glue mesh across two clusters via Argo CD and GitOps and shows successful registration and discovery.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:15Agenda
- 0:52Single Cluster Service Mesh
- 3:20Control Plane Access
- 3:56MultiCluster Service Mesh
- 5:03External Control Points
- 6:16Push Model
- 7:01Concerns
- 7:22Pullbased config
- 8:11Benefits
- 9:05How does it work
- 11:43Can it solve all of our problems
- 12:41Glue Mesh
- 13:10Deploying Meshes Securely
- 14:24Demo
- 16:30Log into ArgoCD
- 18:42Mesh Cuddle Command
- 21:49Mesh Agent Git Repository
- 22:18Mesh Console
- 23:28Wrap Up
related talks
05mBest Practices on Setting up Multi Cluster Service Mesh in AWS
33mSolving Multi-Service Without a Service Mesh
27mBridging Trust Between Multi-Cluster Meshes
33mBuilding a Secure, Multi-Protocol and Multi-Tenant Cluster for Internet-Facing Services [A]
21mSecure ArgoCD Multi-Cluster Management Across Clouds Without Static Tokens
38mBootstrapping Secure Mesos Clusters
43mSharing is NOT Caring: Stop Sharing Your Kubernetes Cluster Credentials
31mConnecting Dots: Unified Hybrid Multi-Cluster Auth Experience With SPIFFE and Cluster Inventory API