The Zero Trust Odyssey: Our Journey to Modernize Internal Access
summary
Replaces legacy NGINX proxies with Cloudflare (WARP, Argo tunnels and Access), using Route 53 partial CNAMEs and ExternalDNS to avoid replatforming; automates at scale with Terraform + Atlantis and two Kubernetes operators (CF tunnel operator, CF app operator) built on an open source SDK called Achilles; migrates ~200 applications across 25+ clusters, removes bastions, supports thousands of developers with per-developer namespaces, scales tunnels to tens of thousands of connections, chooses split tunneling and recovers from a route-deletion incident via Terraform.
AI-written summary · about
chapters (10)
- 0:00Zero Trust at Reddit
- 4:31Legacy access challenges
- 9:03DNS and routing with Cloudflare
- 14:20Split vs full tunnel trade-offs
- 17:35Automating with Terraform
- 26:06Operationalizing migration
- 31:45Legacy migration steps
- 33:34Observability and incident response
- 35:38Lessons learned
- 36:34Q&A
related talks
32mImplementing Zero Trust
27mLeveraging Infrastructure as Code to Create Zero Trust Access to Your Apps and Infrastructure
40mLessons From Our Zero Trust Journey: Successes, Failures & Dodging Pitfalls
35mAutomating Zero-Trust for Cloud Native Applications
26mSecuring Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles
26mTaking Your DevOps Tooling To The Dark Side
45mZero Trusting as a True Cloud Native Dev
38mToward Zero Trust with AI