How the DoD Use Istio for End-to-End Encryption and Authentication
summary
Platform One runs Istio to provide mTLS everywhere for encryption in transit and to enforce SSO by deploying the Istio authservice via Envoy external auth tied to Keycloak, cert-manager and a redis backend; apps are protected by simply add a label to a pod and Envoy filters redirect through OIDC. Deployments span unclassified to secret (including F‑16s and satellite work), rotation and FIPS needs drive PKI integration, and upgrades (Istio 1.5→1.7, EnvoyFilter syntax) remain the biggest operational pain.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:38Agenda
- 1:29Platform 1 Overview
- 7:39Standard Mesh Use Case
- 10:18SSO for Free
- 12:50Auth Service
- 15:02Envoy Filter
- 16:00Service Mesh
- 17:21Hello World
- 25:36Improvements
- 31:10Challenges
- 34:57OSS
- 41:33Next Steps
related talks
18mIstio for Controls Compliance
32mIstio: Sailing to a Secure Services Mesh
48mSecuring Kubernetes with Istio
48mIstio An open platform to connect, manage, and secure microservices
41mHow the Department of Defense Moved to Kubernetes and Istio
32mIstio: Weaving the Service Mesh [I]
42mIstio: Weaving, Securing and Observing microservices
06mWhat's New in Istio?