Your Perimeter Is Already Dead: Zero Trust with Keycloak and SPIFFE
Running Keycloak doesn't make your architecture Zero Trust, and mTLS at the ingress doesn't either. I want to show what it actually takes in a real k8s cluster: workload identity with SPIFFE/SPIRE, short-lived tokens scoped per service pair, and authentication on every internal call instead of only at the edge. Most of the talk comes from things I've seen break in production, like key rotation failing under load or staging tokens that suddenly work against prod because someone put everything in one realm.
I spend a lot of my consulting time fixing what breaks after someone said "we'll harden it later". A recurring pattern: teams deploy Keycloak, terminate mTLS at the ingress, and call it Zero Trust. Meanwhile every pod can talk to every other pod, service accounts authenticate with static secrets that never expire, and nobody validates the aud claim.
The talk starts with why the perimeter model doesn't survive contact with k8s. Not as an abstract argument but with four incident patterns I've either seen in the field or that are documented in public reports: an API key leaking through /actuator/env, a CI runner with cluster-admin walking through vault into the production database, a JWT sitting in an nginx access log for eight hours waiting to be replayed, and a malicious package reading IMDS credentials because no workload identity check existed.
From there it gets concrete. How Keycloak fits into a Zero Trust setup as the token issuer, and why the enforcement has to live somewhere else. Client credentials flow with proper scoping, 5-minute token lifetimes, audience validation on every request. SPIFFE IDs as workload identity, X.509 SVIDs rotated hourly by SPIRE, so there is no static secret left to steal. Then the full flow end to end: workload attestation, token request over mTLS, local JWT validation with cached JWKS, OPA sidecar for the authorization decision.
The last section is the part people usually thank me for afterwards: the pitfalls. Missing audience validation is the mistake I find in almost every review. JWKS caches that don't invalidate on 401 and turn a routine key rotation into an outage. mTLS that only exists north-south. Shared realms across environments.
You should know OAuth2 basics and have operated something on k8s. There will be a repository with the working setup: Keycloak realm export, SPIRE configs, Rego policies, manifests.
Michael Fuchs is a Software Security Engineer at inovex with a focus on IT security. He supports development projects from the concept phase through implementation and advises teams on DevSecOps strategies, working in particular on strong authentication, security in microservices architectures, and Zero Trust. With coding assistants now part of nearly every developer's toolkit, he looks at what their adoption means for the security practices these teams rely on.