Cloud Security on Bare Metal: Rebuilding VPC Isolation on-prem with Istio Ambient Mode

Moving off AWS to on-prem infrastructure often means losing the network isolation you get for free via VPCs and Security Groups. On bare metal, the network is flat by default, leaving sensitive internal services and customer-facing APIs exposed in the same cluster. Waiting on traditional infrastructure teams for firewall changes can completely stall a fast-moving migration.

In this talk, we share how we solved this constraint on an EKS Hybrid deployment using Istio Ambient Mode to build a workload-level isolation layer without filing a single infrastructure ticket. We’ll break down our four-layer defense-in-depth framework: enforcing global deny policies, leveraging cryptographically verified SPIFFE identities, implementing DNS intercepted egress controls, and anchoring it all with a kernel-level NetworkPolicy backstop.

You will leave this session with a practical mental model and production-ready patterns to secure your cluster when the underlying hardware doesn't have your back.

1. A Blueprint for Hybrid Security: A reusable 4-layer framework to secure Kubernetes clusters on flat networks.

2. Ambient Mode Reality Check: A clear understanding of when to choose Istio Ambient mode over Sidecars, and what gaps to prepare for.

3. Actionable Security Code: Knowledge of how to combine SPIFFE identity checking with Linux kernel-level network policies for defense-in-depth.