►
Description
Keynote: Progress Toward Zero Trust Kubernetes Networks - Spike Curtis, Senior Software Engineer, Tigera
Tigera’s Spike Curtis will share how enterprises are starting to embrace a zero trust network security posture, and demonstrate how such an approach can be enabled within an orchestrated environment such as Kubernetes by combining service mesh and network policy with a multi-factor authentication, authorization and encryption strategy.
About Spike Curtis
Spike Curtis is a lead developer on Istio working for Tigera. He was also a core developer for Calico and worked on the initial integrations with Docker, Kubernetes and Mesos. Spike earned his PhD from the University of Oxford where he worked on quantum computing with ion traps. He has also worked for Silicon Valley start-ups Palantir Technologies and Rigetti Computing.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
Morning,
it's
great
to
be
here.
My
name
is
Spike
Curtis
and
I.
Am
a
software
engineer
at
tae,
Guerra
tae
Guerra
we're
losing
the
slides,
so
tae
Guerra
is
a
contributor
to
sto
and
to
kubernetes
we're
maintainer
x'
of
flannel
and
the
CNI
and
our
flagship
as
Kelsey
said
this
project
calico
and
all
your
favorites
hosted.
Kubernetes
services
have
chosen
project
calico
as
the
implementation
for
network
policy,
and
we
build
these
technologies
because
our
mission
is
to
provide
secure
application.
Connectivity
for
the
cloud
native
world
and
secure
application.
A
Connectivity
is
becoming
increasingly
important
for
two
reasons.
Firstly,
our
applications
are
becoming
much
more
distributed,
many
more
components
and
attack
vectors
and,
secondly,
attacks
have
become
much
more
sophisticated,
especially
over
the
last
few
years.
Our
security
planning
has
to
answer
the
question:
what
happens
if
a
workload
is
compromised?
If
we
don't
have
a
plan,
then
one
tiny
toehold
will
allow
attackers
to
completely
own
us
so
to
deal
with
this
problem.
We
invented
Network
segmentation,
net
micro
segmentation,
of
course,
the
logical
conclusion
of
this.
A
The
current
best
practice
is
to
enforce
access
control
around
each
and
every
workload.
Now,
unfortunately,
our
security
planning
has
to
answer
the
question:
what
happens
if
the
network
itself
is
compromised?
What
happens
if
attackers
can
intercept
our
data
or
smooth
traffic?
Now
we
all
know
this
is
possible
on
the
public
internet,
but
it's
simply
no
longer
a
safe
assumption
that
our
data
centers
are
private
clouds.
Our
virtual
private
clouds
have
not
been
breached.
We
have
a
ton
of
evidence
that
criminal
organizations
routinely
penetrate
the
network
itself.
A
So
to
deal
with
this,
we
can
use
end-to-end
encryption
and
authorization
and
authentication
now
I
know
what
you're
thinking
this
seems
really
hard
really
complicated.
How
are
we
gonna
get
there?
Well,
ty
Guerra
and
the
rest
of
the
community
have
been
working
on
these
prop
for
some
time,
and
we
have
many
of
the
building
blocks
that
we
need
for
secure
application.
Connectivity,
kubernetes
network
policy
is
a
great
way
to
enforce
application
or
access
control
around
each
and
every
workload
and
I'm
sure
that
you've
heard
a
bunch
about
service
meshes
in
the
sto
project.
A
At
this
cube
con.
The
feature
that
I'm
most
excited
about
in
Sto
is
the
ability
to
set
up
mutually
authenticated
TLS
connections.
Sto
will
authenticate
both
ends
of
the
connection
and
encrypt
your
data,
and
the
best
part
is
no
application
code
changes.
You
don't
even
need
to
add
HTTPS
to
your
to
your
urls
sto
handles
this
all
transparently,
so
we
had
these
great
building
blocks.
But
how
do
you
deploy
them
together?
A
Well,
today,
you
would
configure
network
policy
and
then
you
would
configure
sto
with
any
application
layer
rules,
but
there's
a
gap,
because
it's
really
painful
to
keep
things
in
sync
and
you
might
leave
the
door
ajar
for
attackers
or
cause
production
outages.
So
today
we're
announcing
calico
support
for
an
application
layer
policy
seamlessly
combining
kubernetes
network
policy
and
sto
security
features
into
a
unified
policy
for
secure
application
connectivity.
A
On
the
other
end
of
a
connection
and
in
Calico
policy,
we
enforce
this
at
multiple
layers.
We
have
the
cryptographic
identity,
but
we
also
use
the
network
information.
It's
like
two
factor
auth,
but
for
pods
and
working
with
Sto
means
that
we
now
have
access
to
request
attributes
from
the
application
layer.
So
we
can
really
scope
down
policy
and
bring
it
down
to
least
privileged.
A
So
when
we
put
this
together,
we
can
build
application
that
are
that
are
resilient
to
attacks
like
never
before,
and
this
design
of
planning
for
breaches
to
our
workloads
and
reaches
to
our
networks
by
reducing
trust
in
the
network
is
called
the
zero
trust
network
model.
Now,
historically,
it
was
really
hard
to
build
zero
trust
designs,
because
you
had
to
write
a
bunch
of
custom
code.
It
was
really
hard
to
authenticate
and
authorize
every
flow.
It
was
really
hard
to
calculate
pause
to
be
from
from
multiple
data
sources.
A
Calico
application
layer
policy
is
a
huge
step
forward
because
it
gives
us
both
of
these
capabilities
right
out
of
the
box.
So
these
new
features
of
calico
are
available
in
tech
preview
check
it
out
on
github
that'll.
Show
you
how
to
set
up
a
test
cluster,
kick
the
tires
and
tell
us
what
you
think,
I'm,
also
giving
a
talk
with
Dan
Berg
of
IBM,
where
we'll
be
doing
a
deep
dive
on
sto
security,
including
a
demonstration
of
calico
application
layer
policy.
A
That's
tomorrow
at
11:55
and
I
hope,
you'll
join
us
and
one
more
thing
before
I
go.
Tae
Guerra
is
announcing
cnx,
which
is
an
enterprise
offering
for
secure
application,
connectivity
built
from
calico
and
sto.
It
has
enhanced
controls
and
visibility
tools,
specifically
designed
for
enterprise
processes
and
compliance
requirements
and,
of
course,
enterprise
grade
support
so
check
it
out.
Thank
you.