Cloud Native
Security Talks RSS

KubeCon North America 2019

How Yelp Moved Security From the App to the Mesh with Envoy and OPA

Daniel Popescu, Yelp & Ben Plotnick, Cruise

Abstract

From its inception, Yelp’s service infrastructure has treated security as a fundamental component. For many years, developers carried the burden of building security features directly into their services. By using standard cloud native building blocks, the service infrastructure now provides security features by default; this enables hundreds of developers to focus on shipping features for more than 100M monthly active Yelp users.This talk will cover Yelp’s journey from a legacy service proxy to a modern, secure service mesh based on Envoy and Open Policy Agent. It will discuss-Authn and Authz mechanisms using mTLS and JWT with Envoy and OPA-Migration from using an in-house policy decision engine to standardized open source tools (OPA)-Transpiling legacy policy data to rego and other best practices for policy maintenance-Strategies for quickly and safely rolling out policy changes

More from KubeCon North America 2019

Open in the index →
  1. Walls Within Walls: What if Your Attacker Knows Parkour?Tim Allclair & Greg Castle, Google 2019-11-19
  2. The Devil in the Details: Kubernetes’ First Security AssessmentAaron Small, Google & Jay Beale, InGuardians 2019-11-19
  3. Panel: Control Plane vs Data Plane: Untangling the Tenets of MultitenancyTasha Drew, VMware; Sanjeev Rampal, Cisco; Ryan Bezdicek, Cray Inc.; Adrian Ludwin, Google; & Fei Guo, Alibaba 2019-11-19
  4. Enforcing Automatic mTLS with Linkerd and OPA GatekeeperIvan Sim, Buoyant & Rita Zhang, Microsoft 2019-11-19
  5. CAP_NET_RAW and ARP Spoofing in Your Cluster: It's Going Downhill From HereLiz Rice, Aqua Security 2019-11-19
  6. Redesigning Notary in a Multi-registry WorldJustin Cormack, Docker 2019-11-20
  7. Piloting Around the Rocks: Avoiding Threats in KubernetesRobert Tonic & Stefan Edwards, Trail of Bits 2019-11-20
  8. No video On the Security of Copying To and From Live ContainersAriel Zelivansky & Yuval Avrahami, Palo Alto Networks 2019-11-20
  9. Knative - The Security Platypus?Ariel Shuper, Aqua Security 2019-11-20
  10. Binary Authorization in KubernetesAysylu Greenberg, Google & Liron Levin, Palo Alto Networks 2019-11-20
  11. Securing Communication Between Meshes and Beyond with SPIFFE FederationEvan Gilman, Scytale & Oliver Liu, Google 2019-11-21
  12. Prepare to Be Boarded! A Tale of Kubernetes, Plunder, and CryptobootyJames Condon, Lacework 2019-11-21
  13. Kubernetes Policy Enforcement Using OPA At Goldman SachsMiguel Uzcategui, Goldman Sachs & Tim Hinrichs, Styra 2019-11-21
  14. Identity Bootstrapping in Multi-tenant Multi-cluster KubernetesManish Mehta, Volterra & Derek Suzuki, The Voleon Group 2019-11-21
  15. How Kubernetes Components Communicate Securely in Your ClusterMaya Kaczorowski, Google 2019-11-21