Lightning Talk: How to deploy mutually authenticated TLS without ruining everything - Spike Curtis

Lightning Talk: How to deploy mutually authenticated TLS without ruining everything - Spike Curtis, Tigera

TLS with mandatory mutual authentication is the gold standard for communication in distributed applications and forms the backbone of a Zero Trust Network. Envoy can do it for you with no application code changes, but if you just “turn it on” in a live production cluster you’ll quickly find you have a major disruption on your hand.

In this presentation, Spike will explain and demonstrate how to take a production cluster from a completely unencrypted to fully secured without dropping traffic. The demonstration will use Istio, but Spike will explain conceptually and cover the Envoy config changes being made in each step so the techniques can be applied to any Envoy service mesh.

[HaseenHaq]

We developers have a fascination with 'look how I can do this in seconds and voila' tendencies in real life and we take it to conference and talks and 6 out of time we fail. Not because we don't know how to do things but reeber there is a value of unit testing that we don't get a chance to do in that setup. We should rather spend time about how things work. In this case, how certificates are obtained, how they interact in less than 3 minutes and it would have been much more producting. The icing on the cake was the question where rather than audience asking how it works under the covers, another developer was interested in knowing "why did it fail?".

[ChristopherFranko]

My man needs to work on the Uh's and Um's.

[prat-man]

Does mTLS use certificates (like say from PKI), if so how/ from where? I'm a newbie..