Hardening Northstar's Istio service mesh: the eight-domain mesh security board — identity with SPIFFE IDs not IPs, STRICT mTLS everywhere, deny-by-default authorization, traffic limits, a hardened ingress gateway, short-lived certificates with a guarded CA, observability and admission-control policy; a map of east-west calls from the ingress gateway through checkout to payments, inventory and pricing, every hop encrypted and authorised, while a compromised debug pod's call to payments is denied; and the console proof that PeerAuthentication is STRICT and payments allows only checkout's SPIFFE identity.

CY-MID-094Mid Level · Service Mesh Security

Service Mesh Security — The Mesh Security Board

A hands-on mid-level course that secures service-to-service traffic with a service mesh. Work the mesh security board - eight domains: Identity, mTLS, Authorization, Traffic, Ingress, Secrets, Observability, and Policy - giving every workload an identity and encrypting and authorizing every call between services. Strictly defensive. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Give every workload a strong identity (SPIFFE/mTLS).
Enforce mutual TLS and least-privilege authorization between services.
Control traffic and secure ingress and egress.
Observe and policy-govern the mesh.

Price:৳8,000