As we move toward cloud-native infrastructure and build our applications with microservices, we must fully face the drawbacks and challenges involved. One of the most important aspects is securing (through authentication and authorization) the services correctly. In this session, we’ll show how Istio can simplify your security model when adopting (micro) services architecture. We expect most developers haven’t adequately solved these issues, so we’ll take it step by step and build a strong understanding of Istio and how it is used to secure the service mesh.

1. 1
Improving Security with Istio
Homework dn.dev/istio -tutorial
dn.dev/istiomaster

2. dn.dev/istiomaster
Alex Soto (lordofthejars.com)
● @alexsotob
● asotobue@redhat.com
● Currently Red Hat’s Director of Developer Experience
● Featured speaker at technology events around the globe
● A Java Champion since 2017
● Writer, University Professor, Radio collaborator
● A big fan of testing and continuous delivery in 21st century

3. dn.dev/istiomaster
https://reg.rainfocus.com/flow/redhat/sum21/regGeneralAttendee/login

4. dn.dev/istiomaster
Love Thy Mono
Old School
New School

5. dn.dev/istiomaster
OS
JVM
Service C
Microservices == Distributed Computing
OS
JVM
Service B
OS
JVM
Service A

6. dn.dev/istiomaster
MyService
Monitoring
Tracing
API
Discovery
Invocation
Resilience
Pipeline
Authentication
Logging Elasticity
Microservices'ilities

7. dn.dev/istiomaster
Microservices embedding Capabilities
Container
JVM
Service B
Discovery
Load-balancer
Resiliency
Metrics
Tracing
Container
JVM
Service A
Discovery
Load-balancer
Resiliency
Metrics
Tracing
Container
JVM
Service C
Discovery
Load-balancer
Resiliency
Metrics
Tracing

8. dn.dev/istiomaster

9. dn.dev/istiomaster
MyService
Monitoring
Tracing
API
Discovery
Invocation
Resilience
Pipeline
Authentication
Logging Elasticity
Microservices'ilities + Kubernetes

10. dn.dev/istiomaster
MyService
Monitoring
Tracing
API
Discovery
Invocation
Resilience
Pipeline
Authentication
Logging Elasticity
Microservices'ilities + OpenShift

11. dn.dev/istiomaster
Istio - Sail
(Kubernetes - Helmsman or ship’s pilot)

12. dn.dev/istiomaster
MyService
Monitoring
Tracing
API
Discovery
Invocation
Resilience
Pipeline
Authentication
Logging Elasticity
Microservices'ilities + Istio

13. dn.dev/istiomaster
Microservices embedding Capabilities
Container
JVM
Service B
Discovery
Load-balancer
Resiliency
Metrics
Tracing
Container
JVM
Service A
Discovery
Load-balancer
Resiliency
Metrics
Tracing
Container
JVM
Service C
Discovery
Load-balancer
Resiliency
Metrics
Tracing
Before Istio

14. dn.dev/istiomaster
https://www.imz-ural.com/blog/waffles-the-sidecar-dog
Sidecar

15. dn.dev/istiomaster
Microservices externalizing Capabilities
Pod
Container
JVM
Service A
Sidecar Container
Pod
Container
JVM
Service C
Sidecar Container
Pod
Container
JVM
Service B
Sidecar Container
After Istio
The sidecar intercepts all network traffic

16. dn.dev/istiomaster
Security

17. dn.dev/istiomaster
• Egress Blocking
• mTLS - Encryption
• Access Control
• JSON Web Token (JWT) Authentication
• Role-based Access Control (RBAC) Authorization
Istio Security Capabilities

18. dn.dev/istiomaster
Most Communication Inbound & Internal

19. dn.dev/istiomaster
Egress Blocking
✓

20. dn.dev/istiomaster
Why Encryption?
Pod
Customer
Pod
Preference
Pod
Recommendation

21. dn.dev/istiomaster
Why Encryption?
Pod
Customer
Pod
Preference
Pod
Recommendation
Big Money Customer Engineering Team

22. dn.dev/istiomaster
Why Encryption?
Pod
Customer
Pod
Preference
Pod
Recommendation
Big Money Customer Engineering Team
Pod
Eavesdropper

23. dn.dev/istiomaster
Eavesdropper

24. dn.dev/istiomaster
Access Control
Pod
Recommendation
istio-proxy
Pod
Preference
istio-proxy
Pod
Customer
istio-proxy ✓ ✓

25. dn.dev/istiomaster
Access Control
Pod
Recommendation
istio-proxy
Pod
Preference
istio-proxy
Pod
Customer
istio-proxy ✓ ✓

26. dn.dev/istiomaster
Access Control
Pod
Recommendation
istio-proxy
Pod
Preference
istio-proxy
Pod
Customer
istio-proxy ✓ ✓
✓

27. dn.dev/istiomaster
JWT Issuer

28. dn.dev/istiomaster
Exercises
dn.dev/istio-tutorial

29. dn.dev/istiomaster
The End