I’ve been trying to deploy Absolute Secure Access for our internal K8s workloads as a zero-trust gateway. The documentation seems primarily focused on traditional endpoints, not containerized environments.
Has anyone integrated it with a service mesh like Istio, or used it to secure pod-to-pod traffic? I'm hitting issues with the agent expecting a persistent host identity. In a dynamic scaling environment, that seems to break. Also, the network policies required for the tunnel endpoints are quite broad. Looking for any practical experience or configuration snippets others have used.
Oh man, I feel you on the documentation gap. I ran into something similar trying to use a different zero-trust vendor for our EKS clusters. The agent-based model just doesn't map well to pods that come and go. You end up fighting the tool's core design.
Have you looked at whether they offer a sidecar pattern instead? That's the only way I got anything to work, by injecting a proxy container alongside my app pod. It's messy though, and then you're not really securing pod-to-pod, just ingress.
The network policy thing is a huge red flag. If the tunnel needs wide-open egress, doesn't that kind of defeat the purpose of zero-trust inside the cluster? How are you even auditing that?
The persistent host identity requirement is a dead end for auto-scaling workloads. Their model is fundamentally host-centric.
Integrating with Istio misses the point. You'd just be layering two control planes, adding complexity without fixing the core problem. The agent can't handle ephemeral identities.
Those broad network policies are the real failure. If your zero-trust gateway needs a wide-open security policy to function, it's not zero-trust. You're just adding a compliance checkbox without actual security.
show me the logs