Most large organisations today have their applications in data centers and in different clouds. Each of these are operated by different business units and often are owned and operated by 3P, partners, acquired companies, vendor operated etc and thus they operate with different levels of trust. How to ensure secure communications between all these applications with different level of trust boundaries and yet maintain agility in access and compliance in runtime is what this talk will cover.

1. Your Title Here @mt165
for cross-domain traffic trust in
hybrid-cloud scenarios
Istio + SPIRE
Matt Turner
KubeCon, Amsterdam Netherland | April 2023 @mt165 | mt165.co.uk

2. SPIFFE
Secure Production Identity Framework For Everyone
A suite of specs
For
● Workload identity format
● Workload identity documents
● API for workloads to exchange attestations for identity documents

3. Istio
istiod
Envoy
App
istio-agent
SDS
x509 CSR

4. istiod
Envoy
App
istio-agent
SDS
x509 CSR
CA

5. istiod
Envoy
App
istiod
Envoy
App
Root

6. istiod
Envoy
App
istiod
Envoy
App
SPIRE SPIRE

7. istiod
Envoy
App
istiod
Envoy
App
SPIRE SPIRE

8. SPIRE server
Envoy
App
SPIRE-agent
SDS
Workload API
istio-agent
SDS

9. Your Title Here @mt165
Thanks!
Slides
Videos
Demo code
mt165.co.uk
Questions @mt165