Cloud Native
Security Talks RSS

KubeCon Europe 2019

Envoy SDS: Fortifying Istio Security

Yonggang Liu & Quanjie Lin, Google

Abstract

In Istio 1.1, Citadel Agent is introduced to dynamically provision x.509 certificates and private keys to workloads through the Envoy Secret Discovery Service (SDS) API. Running on Kubernetes nodes as DaemonSets and standalone on VMs, Citadel Agents improve security by making sure the generated private keys never leave the node and can be securely delivered to workloads via UDS. Citadel Agent also offers flexibility on local workload identity attestation and various adapters to integrate with custom CAs.In this talk we will demonstrate how SDS makes this model really efficient, and citadel working independently from other Istio components for both K8s and non-K8s workloads.

More from KubeCon Europe 2019

Open in the index →
  1. Using eBPF to Bring Kubernetes-Aware Security to the Linux KernelDan Wendlandt, Isovalent 2019-05-21
  2. Portable, Universal Single Sign-On for Your ClustersMiguel Martinez, Bitnami 2019-05-21
  3. Kubernetes + Encrypted Memory = Security * PrivacyHarshal Patil & Pradipta Banerjee, IBM 2019-05-21
  4. Fine-Grained Permissions in Kubernetes: What’s Missing, and How to Fix ThatVallery Lancey, Lyft & Seth McCombs, Triller 2019-05-21
  5. Zero Trust Service Mesh with Calico, SPIRE, and EnvoyShaun Crampton, Tigera & Evan Gilman, Scytale 2019-05-22
  6. Smarter Kubernetes Access Control: A Simpler Approach to AuthRob Scott, ReactiveOps 2019-05-22
  7. Inside the CNCF Project Security ReviewsJustin Cormack, Docker 2019-05-22
  8. Crafty Requests: Deep Dive Into Kubernetes CVE-2018-1002105Ian Coldwater, Heroku 2019-05-22
  9. Container Forensics: What to Do When Your Cluster is a ClusterMaya Kaczorowski & Ann Wallace, Google 2019-05-22
  10. Caller ID in KubernetesMichael Danese, Google 2019-05-22
  11. Uber x Security: Why and How We Built Our Workload Identity PlatformTyler Julian, Uber & Daniel Feldman, Scytale 2019-05-23
  12. Securing Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman, Scytale, Inc. 2019-05-23
  13. Securing Kubernetes with Trusted Platform Module (TPM)Alex Tcherniakhovski & Andrew Lytvynov, Google 2019-05-23
  14. Secrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8sRita Zhang, Microsoft & Anubhav Mishra, HashiCorp 2019-05-23
  15. Protecting the Data LakeAsh Narkar, Styra, Inc 2019-05-23
  16. DIY Pen-Testing for Your Kubernetes ClusterLiz Rice, Aqua Security 2019-05-23