Michael Fuchs
Michael Fuchs is a Software Security Engineer at inovex with a focus on IT security. He supports development projects from the concept phase through implementation and advises teams on DevSecOps strategies, working in particular on strong authentication, security in microservices architectures, and Zero Trust. With coding assistants now part of nearly every developer's toolkit, he looks at what their adoption means for the security practices these teams rely on.
Session
Running Keycloak doesn't make your architecture Zero Trust, and mTLS at the ingress doesn't either. I want to show what it actually takes in a real k8s cluster: workload identity with SPIFFE/SPIRE, short-lived tokens scoped per service pair, and authentication on every internal call instead of only at the edge. Most of the talk comes from things I've seen break in production, like key rotation failing under load or staging tokens that suddenly work against prod because someone put everything in one realm.