apidays LIVE New York 2021 - How to Achieve Zero-Trust Security with Kuma Service Mesh by Marco Palladino, Kong
0 likes201 views
This document discusses Kuma, a service mesh that provides zero-trust security and connectivity across Kubernetes and multi-cloud environments. It emphasizes Kuma's abilities to intelligently route traffic, restrict access by default until identity is verified, and provide out-of-the-box connectivity across clusters, clouds, and platforms. Key features highlighted include universal usage across K8s and VMs, attribute-based policies, built-in multi-zone connectivity, and being Kubernetes native, with CLI, HTTP API and built-in GUI for easy usage and policy-based control of security, traffic, and observability.
![THE CLOUD
CONNECTIVITY COMPANY
IN KONG MESH
type: OPAPolicy
mesh: default
name: opa-1
selectors:
- match:
kuma.io/service: backend
conf:
policy:
inlineString: |
package envoy.authz
import input.attributes.request.http as http_request
default allow = false
token = {"valid": valid, "payload": payload} {
[_, encoded] := split(http_request.headers.authorization, " ")
[valid, _, payload] := io.jwt.decode_verify(encoded, {"secret":
"secret"})
}
allow {
is_token_valid
action_allowed
}](https://image.slidesharecdn.com/apidayszerotrustmarcopalladino-210807010132/85/apidays-LIVE-New-York-2021-How-to-Achieve-Zero-Trust-Security-with-Kuma-Service-Mesh-by-Marco-Palladino-Kong-24-320.jpg)
apidays LIVE New York 2021 - How to Achieve Zero-Trust Security with Kuma Service Mesh by Marco Palladino, Kong
- 1. THE CLOUD CONNECTIVITY COMPANY THE CLOUD CONNECTIVITY COMPANY With Kuma THE CLOUD CONNECTIVITY COMPANY 1 https://konghq.com https://kuma.io Zero-Trust
- 2. THE CLOUD CONNECTIVITY COMPANY P A L L A D I N O Marco CO-FOUNDER & CTO AT KONG
- 3. THE CLOUD CONNECTIVITY COMPANY Connectivity Powers Innovation CONNECTIVITY NUMBER OF SERVICES
- 4. THE CLOUD CONNECTIVITY COMPANY Trust is exploitable 4
- 5. THE CLOUD CONNECTIVITY COMPANY Trust is exploitable 5 X
- 8. THE CLOUD CONNECTIVITY COMPANY ZERO-TRUST SECURITY We need virtual passports for our services. 8
- 16. THE CLOUD CONNECTIVITY COMPANY 1. Kubernetes, VMs, Multi-Cloud 2. Single and Multi-Zone 3. Multi-Mesh, Native Policies, Easy to Use 900+ Organizations Have deployed Kuma as a Service Mesh in the past 12 months C O N T R O L P L A N E SERVICE S E R V I C E Sandbox Project
- 17. THE CLOUD CONNECTIVITY COMPANY Multi-Mesh And Easy To Use & Scale Universal (K8s + VMs), Attribute-Based Policies & More Built-in Multi Zone Connectivity Intelligently route traffic across any platform and any cloud to meet expectations and SLAs Restrict access and encrypt all traffic by default to only complete transactions when identity is verified Out of the box connectivity across multi-cluster, multi-cloud and multi-platform deployments across the world.
- 19. THE CLOUD CONNECTIVITY COMPANY Kubernetes Native (CRDs) Universal CLI HTTP API Built-in GUI EASY TO USE
- 20. THE CLOUD CONNECTIVITY COMPANY Security Traffic Control Observability Advanced Policies POLICY BASED
- 21. THE CLOUD CONNECTIVITY COMPANY 70+ Observability Charts Native API Gateway Integration One-Click Zero Trust BATTERIES INCLUDED
- 22. THE CLOUD CONNECTIVITY COMPANY ZERO TRUST WITH KUMA apiVersion: kuma.io/v1alpha1 kind: Mesh metadata: name: default spec: mtls: enabledBackend: ca-1 backends: - name: ca-1 type: builtin dpCert: rotation: expiration: 1d conf: caCert: RSAbits: 2048 expiration: 10y
- 23. THE CLOUD CONNECTIVITY COMPANY ZERO TRUST WITH KUMA apiVersion: kuma.io/v1alpha1 kind: TrafficPermission mesh: default metadata: name: allow-all-traffic spec: sources: - match: kuma.io/service: '*' destinations: - match: kuma.io/service: '*'
- 24. THE CLOUD CONNECTIVITY COMPANY IN KONG MESH type: OPAPolicy mesh: default name: opa-1 selectors: - match: kuma.io/service: backend conf: policy: inlineString: | package envoy.authz import input.attributes.request.http as http_request default allow = false token = {"valid": valid, "payload": payload} { [_, encoded] := split(http_request.headers.authorization, " ") [valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"}) } allow { is_token_valid action_allowed }
- 26. THE CLOUD CONNECTIVITY COMPANY 26 More Connectivity Zero Trust Service Mesh Kuma
- 27. THE CLOUD CONNECTIVITY COMPANY 27 Download at KUMA.IO Enterprise Offering: konghq.com/kong-mesh