Redis TLS Origination through the sidecar Author: Sam Stoelinga | Twitter: samosx | GitHub: samos123 Based on blog post: https://samos-it.com/posts/securing-redis-istio-tls-origniation-termination Architecture: K8s app using Redis over TLS only app-1 Namespace ms-1 K8s Pod External DB ms-2 K8s Pod ms-3 K8s Pod TLS only ● App with multiple microservices ● external Redis TLS only ● each microservice microservice talks to Redis 1. Tedious configuration in the application 2. Improved visibility into Redis traffic Istio TLS Origination Architecture: K8s app using Redis over TLS only (TLS origination)

models PostgreSQL Arrays Extensions Pgpass authentication SSPI authentication (Windows SSO) Redis Salesforce Salesforce authentication SQLite Teradata AWS Athena DocumentDB Keyspaces Redshift "athena:Batch*", "athena:StartQueryExecution", "athena:StopQueryExecution" AmazonAthenaFullAccess Redis AmazonElastiCacheReadOnlyAccess AmazonElastiCacheFullAccess Managing AWS permissions DBeaver Lite Guide 24.2.ea. Page 345 of 1010. Overview Redis specialty Setting Up Redis connection settings Connection details Secure Connection Configurations Redis Features in DBeaver Browsing keys Executing

models PostgreSQL Arrays Extensions Pgpass authentication SSPI authentication (Windows SSO) Redis Salesforce Salesforce authentication SQLite Teradata AWS Athena Cloud DBeaver Ultimate User Redshift Amazon Athena Amazon DocumentDB Amazon DynamoDB Amazon Keyspaces Amazon ElastiCache (Redis) Amazon Timestream Amazon Neptune Google Cloud Platform AlloyDB for PostgreSQL Microsoft SQL Server "athena:Batch*", "athena:StartQueryExecution", "athena:StopQueryExecution" AmazonAthenaFullAccess Redis AmazonElastiCacheReadOnlyAccess AmazonElastiCacheFullAccess Managing AWS permissions DBeaver Ultimate

models PostgreSQL Arrays Extensions Pgpass authentication SSPI authentication (Windows SSO) Redis Salesforce Salesforce authentication SQLite Teradata Cloud DBeaver User Guide 24.2.ea. Page Redshift Amazon Athena Amazon DocumentDB Amazon DynamoDB Amazon Keyspaces Amazon ElastiCache (Redis) Amazon Timestream Amazon Neptune Google Cloud Platform AlloyDB for PostgreSQL Microsoft SQL Server "athena:Batch*", "athena:StartQueryExecution", "athena:StopQueryExecution" AmazonAthenaFullAccess Redis AmazonElastiCacheReadOnlyAccess AmazonElastiCacheFullAccess Managing AWS permissions DBeaver User

App B AMF App A SMF Frontend SMF Ingress Gateway Redis DB SMF App X AMF Identity SMF Identity SMF Identity 10 ©2021 Aspen Mesh. All rights reserved UDM Virtual Machine Namespace SMF SMF Frontend UDM Egress Gateway Redis DB SMF App X Control Plane UDM Identity 11 ©2021 Aspen Mesh. All rights reserved. SQL DB AMF App B AMF App A SMF Frontend SMF Ingress Gateway Redis DB SMF App X https://aspenmesh.io/how-to-capture-packets-that-dont-exist/ Optical Tap Network

Packages BOSH Manifest/Tile (Instances) Jobs BOSH Release References Postgresql boshrelease Redis boshrelease Docker UAA Smoke Test BOSH dns Core Job Service Admin Server Log Collector Smoke Test UAA Golang HAproxy Keepalived Development Needed Existing Components Database Redis Notary Clair Cloud Platform Specific Proxy/Router HAproxy Keepalived HAproxy Keepalived UAA Smoke

Packages BOSH Manifest/Tile (Instances) Jobs BOSH Release References Postgresql boshrelease Redis boshrelease Docker UAA Smoke Test BOSH dns Core Job Service Admin Server Log Collector Smoke Test UAA Golang HAproxy Keepalived Development Needed Existing Components Database Redis Notary Clair Cloud Platform Specific Proxy/Router HAproxy Keepalived HAproxy Keepalived UAA Smoke