Video by CNCF [Cloud Native Computing Foundation] via YouTube
Don’t miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io
Lightning Talk: Using Keycloak Authorization Service for Kubernetes Service-to-Service Authorization – Halil Özkan, Keymate
Modern Kubernetes environments often centralize identity but still leave service-to-service authorization spread across
application code, gateway rules, and proxy-specific configuration. This session presents a practical pattern for using
Keycloak Authorization Services as a centralized authorization control plane while enforcing decisions at the platform
layer instead of inside each application.
The talk shows how Kubernetes workloads can remain unchanged while a mesh-level Policy Enforcement Point evaluates HTTP
requests using workload identity, request metadata, and centrally managed policy. The architecture uses Istio Ambient
mode, waypoint proxies, a WebAssembly-based enforcement extension, and a Keycloak-backed decision flow.
The session also covers allow and deny behavior, fail-closed handling, bypass-prevention requirements, observability
with OpenTelemetry, and the latency and reliability trade-offs that appear when Keycloak participates in the live
authorization path. A live demo shows both the enforcement path and the operational signals it produces.