cyber.hendryadrian.com
Detection & Defense · aws.amazon.com

Securing Unauthenticated Protocols in Multi-Tenant Kubernetes with mTLS Gateways

· Original article ↗

Summary

AWS describes a multi-tenant EKS architecture that uses namespace-scoped mTLS gateways, NetworkPolicies, JWT validation, and managed TURN relay to secure protocols such as ADB and WebRTC, with reported ADB gateway latency below 50 ms.

Key points

  • The architecture replaces bastion-based ADB port forwarding with namespace-scoped Envoy Gateways that authenticate connections using mTLS.
  • Default-deny NetworkPolicies are required to prevent traffic from bypassing the gateways; AWS Private CA and cert-manager issue and rotate 12-hour namespace certificates.
  • A custom API validates users’ JWTs against an enterprise identity provider, checks namespace assignments, and logs identity, namespace, and connection time.
  • Amazon Kinesis Video Streams provides managed WebRTC TURN relay and IAM-scoped session credentials, replacing self-managed STUNner and its custom token-exchange service.
  • Traffic between Envoy and target pods is not protected by mTLS in the described design; the article recommends assessing this gap and extending mTLS for stricter requirements.
  • AWS reports under 50 ms of added gateway latency for ADB commands, with commands completing in under 100 ms and application installs in under 30 seconds.

Article Details

Defense Focus
Secure unauthenticated TCP and WebRTC protocols in multi-tenant Kubernetes environments through namespace-scoped mutual TLS, JWT-based identity validation, network isolation, and managed TURN relay.
Detection Methods
  • Review custom API session records to identify the authenticated user, namespace, and connection timestamp.
  • Correlate AWS API audit-log entries with the AWS STS RoleSessionName to trace API calls to an individual.
  • Track certificate expiration and renewal activity through cert-manager.
Data Sources
  • Custom API logs containing authenticated identity, namespace, and session timestamp.
  • AWS API audit logs with calls associated with AWS STS RoleSessionName.
  • cert-manager certificate expiry and renewal state.
Platforms
  • Multi-tenant Kubernetes clusters with namespace isolation
  • Enterprise identity providers issuing JWTs
Defensive Actions
  • Apply default-deny NetworkPolicies in each tenant namespace before deploying gateways or issuing certificates; restrict pod ingress to the namespace-scoped gateway.
  • Use namespace-scoped mTLS certificates and configure automatic rotation; the described certificates have a 12-hour lifetime.
  • Validate JWTs and namespace assignments before returning connection details, and log identity, namespace, and timestamp for each session.
  • Scope relay credentials per session and use managed TURN infrastructure for WebRTC traffic.
  • Review gateway configuration, resource limits, and access controls, and apply equivalent security review and logging rigor to the custom authentication API.
  • Assess whether mTLS should also extend from the gateway to pods; use a sidecar proxy or pod-level certificates where required.
  • Add CRL or OCSP infrastructure if immediate certificate revocation is required.

Vendors

Amazon Web Servicespost assumes an EKS cluster with namespace isolation configured, an enterprise IdP that issues JWTs, and AWS Private Certificate Authority (AWS Private CA)—a managed service for issuing private certificates—set up in

Products

Amazon Elastic Kubernetes ServiceIn a multi-tenant Kubernetes cluster—including Amazon Elastic Kubernetes Service (Amazon EKS)—pods can reach other tenants’ open ports by default unless you configure network policies to restrict cross-namespace traffic.AWS Identity and Access ManagementIt replaced the self-managed STUNner because it integrates with AWS Identity and Access Management (IAM), so the custom token-exchange service is no longer needed.AWS Private CAisolation configured, an enterprise IdP that issues JWTs, and AWS Private Certificate Authority (AWS Private CA)—a managed service for issuing private certificates—set up in your account.AWS Security Token Service (AWS STS)The JWT identity chain maps each user to an AWS Security Token Service (AWS STS) RoleSessionName, so every AWS API call in the audit log traces back to a specific person, even in a multi-tenant environment.AWS WAFFor the REST API path, the custom API sits behind AWS WAF.cert-managercert-manager—an open-source Kubernetes add-on that automates certificate issuance and renewal—and the AWS Private CA issuer plugin should already be running in the cluster.CuttlefishIn the Cuttlefish deployment (Cuttlefish is Google’s configurable virtual Android device that runs in containers), the first approach routed this traffic through a bastion host to the Amazon EKS control plane, as FigureEnvoy GatewayThe architecture also assumes permissions to deploy Envoy Gateway, a Kubernetes API gateway built on the Envoy proxy.Kinesis Video Streamscomponents: namespace-scoped mutual TLS (mTLS) gateways, managed TURN relay through Amazon Kinesis Video Streams, and JWT identity chains tied to an enterprise identity provider (IdP).

Related Articles