Lightweight Zero-Trust Network Implementation and Transition with Keycloak and NGINX

This course presents a transition to a zero-trust network model, moving security boundaries from an API gateway toward individual services and pods. It covers JWT validation, OAuth mutual TLS, and token introspection caching, with Keycloak and NGINX in the implementation scenario.

Syllabus

Intro
Session Overview (1/3)
Underlying technology 1.JWT validation
Underlying technology 2' - OAuth MTLS (RFC 8705)
What is Keycloak?
Security boundary transition scenario
Change API Gateway to NGINX Ingress Controller
Shift security boundary to per service
Shift security boundary to per pod
How to achieve JWT validation (east-west traffic)
Where is the chokepoint?
Option A: Cache token introspection responses
Summary