Hands-on Workshop: Zero Trust Networking in Practice with a Service M...
summary
Hands-on setup of Linkerd with cert-manager (and trust-manager) on a Kubernetes cluster: deploy demo app, install cert-manager, create a self-signed root CA and a 48-hour intermediate cert, install Linkerd control plane and inject proxies, then apply a namespace default-deny with explicit exceptions model. Workshop shows mTLS issuance per pod via Linkerd, how cert rotation works, how HTTPRoute-based fine-grained authz blocks writes until verbs/paths are allowed, and that the demo environment successfully enforces and monitors policy.
AI-written summary · about
chapters (30)
- 0:00Zero Trust workshop intro
- 2:13Presenters overview
- 3:37Cryptographic identity for Kubernetes
- 7:07Cert manager intro and CNCF
- 8:51Cert manager issuers
- 9:55Mutual TLS in service meshes
- 11:20Linkerd service mesh CNCF
- 13:28Demo setup prerequisites
- 15:15Deploying demo app
- 16:58Install cert manager Helm
- 18:45Install cert manager trust
- 20:09Create root and intermediate certs
- 26:34Inspect certs with OpenSSL
- 27:17Linkerd install and config
- 32:16Linkerd architecture
- 35:02Linkerd Viz dashboard
- 36:25Adding applications to the service mesh
- 38:56Verify mesh injection
- 40:22Linkerd auth policies
- 42:33Namespace isolation default deny
- 46:28Allow Viz metrics access
- 47:51Create server objects
- 51:44Allow web traffic
- 54:58Q&A Ingress policies
- 57:38HTTP route policies
- 1:00:06Fixing service health checks
- 1:03:44HTTP route policies APIs
- 1:07:02Fine-grained security
- 1:08:26Workshop recap
- 1:09:30Resources and booth
related talks
29mZero Trust Security with Service Mesh
26mA DevSecOps Approach to Zero Trust Network Security
22mCompliance the Easy Way: Zero-conf mTLS for Dev and smooth Day-2 f...
31mTrust no one: implementing zero trust security with Ambient Service Mesh
28mService Identity - The Key to Zero Trust with Service Mesh
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
45mZero Trusting as a True Cloud Native Dev
52mService Mess to Service Mesh