Presented by Adam Toy, Chief Architect, Rancher Government at Kubernetes Community Days, Washington DC, September 14, 2022. Recap Rancher Desktop: Spin up light-weight Kubernetes on your workstation and drop-in replacement for Docker CLI. Istio Service Mesh: Ensures applications only can access what they need to function, while enforcing encrypted traffic and off-loading work from application business logic. Kubewarden Policy Agent: Enforces Kubernetes policy cluster-wide to protect against bad actors and compliance violations.

1. RGS Proprietary
© RGS 2022
© RGS 2022
Implementing Zero-Trust at
the Department of Defense
with Istio and Rancher
S E P TE M BE R 2 0 2 2
Adam Toy
Chief Architect, Rancher Government

2. RGS Proprietary
© RGS 2022
What is Zero Trust?
Dictionary Definition
A collection of concepts and ideas designed to minimize uncertainty in enforcing accurate,
least privilege per-request access decisions in information systems and services in the face of
a network viewed as compromised.
Practical Implementation
— Criticality/Sensitivity of Applications
— Multi Tenancy vs. Single Tenancy
— Number of Applications/Workloads Supported
— Available Human Resources (Platform Engineers)

3. RGS Proprietary
© RGS 2022
Security Posture
Zero Trust
Least Privilege
Adversarial/Penetration
Testing
Policy Enforcement
Application Configuration
Other Critical Security Components

4. RGS Proprietary
© RGS 2022
Pod
Private Network Space
Pod
Private Network Space
How Istio Works (For Now..)
Application
Container
Istio
Sidecar
Application
Container
Istio
Sidecar
Istio
mTLS

5. RGS Proprietary
© RGS 2022
Demo
Sources:
• Demo Application (Source & Manifests): https://github.com/atoy3731/istio-demo-app
• Kubewarden Istio Policy (Source): https://github.com/atoy3731/kubewarden-istio-policy-rust
Tools:
• Rancher Desktop: https://rancherdesktop.io
• Istio: https://istio.io
• Kubewarden: https://docs.kubewarden.io

6. RGS Proprietary
© RGS 2022
Recap
Rancher Desktop: Spin up light-weight Kubernetes on your workstation and drop-in
replacement for Docker CLI.
Istio Service Mesh: Ensures applications only can access what they need to function, while
enforcing encrypted traffic and off-loading work from application business logic.
Kubewarden Policy Agent: Enforces Kubernetes policy cluster-wide to protect against bad
actors and compliance violations.

7. RGS Proprietary
© RGS 2022
© RGS 2022
Thank You!
Rancher Government Solutions
1900 Reston Metro Plaza
Suite 600
Reston, VA, 20190
https://www.ranchergoverment.com
CAGE code: 8GLZ3
DUNS: 117387835