Service Identity - The Key to Zero Trust with Service Mesh
summary
Service mesh implements per-workload cryptographic identities and uses sidecar proxies to enforce mTLS between proxies so every service authenticates each call. Demos show Istio (Citadel), Linkerd and Open Service Mesh accepting a custom intermediate CA from an enterprise PKI, issuing X.509s with SPIFFE URIs and rotating keys, and proxies successfully verifying certificates and presenting client certs. The result: automated, short‑lived machine identities issued from an existing CA and usable for authorization and audit.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:31About JetStack
- 1:44Agenda
- 2:30Traditional Network Security
- 3:30Cloud Network Security
- 7:01Service Mesh
- 9:18Mutual TLS
- 14:27Iso
- 18:30LinkedIn
- 21:09Open Service Mesh
- 24:17Wrapup
related talks
32mIstio: Sailing to a Secure Services Mesh
31mTrust no one: implementing zero trust security with Ambient Service Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
10mService Mesh Security in a Nutshell
41mZero-Trust Networks: Identity, AuthN, AuthZ, Audit- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
29mZero Trust Security with Service Mesh
33mSolving Multi-Service Without a Service Mesh