AI
Why VPNs Leave Internal Networks Exposed
VPNs act as a single front gate. Once inside, users and automated systems can scan and probe every endpoint on the network. Before AI agents, that was manageable for human traffic alone. Now an AI given VPN access can pull information from every visible service, then act on it in unexpected ways. A compromised single identity, as a breach disclosed at the conference showed, causes cascading damage across any service that trusts the perimeter.
Reverse Proxy as Per-Endpoint Identity Gate
Envoy sits in front of any service and handles authentication and authorization so the service itself does not have to. Legacy databases with no TLS support gain a consistent identity check without any code changes. A single Envoy instance multiplexes multiple backends, routing user A to backend Z and user B to backend A based on identity claims. The service never sees unidentified traffic, and the proxy handles TLS for services that cannot do it themselves.
JWTs as Short-Lived Identity Tokens
Keycloak issues a JWT when a user authenticates via OIDC. The token carries issuer, audience, username, realm access roles, and an expiration. In the demo the TTL is 5 minutes. Envoy validates this token on each request. JWTs encode identity but do not encrypt it, so the spec is clear: do not put secrets in a JWT. The short TTL eliminates long-lived static credentials that can be stolen and replayed weeks later.
How Keycloak and Envoy Enforce Per-User Access
The demo runs from a Docker Compose file containing Keycloak, Envoy, and several backend endpoints. Without a token, curl returns 401. With Alice’s JWT passed as a bearer token, the same endpoint returns 200. Alice cannot reach Bob’s private workspace, returning 403. Bob has an admin role but still gets 403 on Alice’s data. The routing rules enforce identity, not just role. Envoy logs each attempt with the username attached.
Identity-Aware Audit Logs and the Intent Chain
An IP address in a log tells you a machine contacted an endpoint. An identity-aware log tells you Bob tried to reach Alice’s data, was denied with a 403, at a specific time. That difference matters for GDPR, PCI, and SOC 2 auditors. It also matters when an AI agent acts on behalf of a user: the log needs to show Bob initiated the agent and the agent took the action. Boris called this the intent chain.
Q&A
When you route a service through Envoy, do clients need to be reconfigured to trust new certificates? Services need to trust Envoy as the proxy entry point, but Envoy handles the auth layer so the service logic itself stays unchanged. ▶ 23:41
VPNs operate at L3 while Envoy works at L4/L7. Can JWT-based identity always be injected for raw TCP connections? For machine-to-machine traffic, tools like SPIFFE with mTLS fill the gap; Envoy alone may not cover every legacy TCP endpoint without additional workflow changes. ▶ 26:14
Notable Quotes
When an AI is inside of your network and Peter O’Neill · ▶ 13:24
“What is IBA?” Intent-based Boris Kurktchiev · ▶ 22:10
the win you get is higher than the pain Peter O’Neill · ▶ 26:02
Key Takeaways
- VPNs grant full network access on entry; every service behind them is visible to anyone who gets in.
- Keycloak and Envoy add per-endpoint identity checks without requiring the service to handle auth.
- JWT TTLs as short as 5 minutes eliminate long-lived static credentials that can be stolen or replayed.
- Identity-aware logs record who tried what, enabling compliance proof for GDPR, PCI, and SOC 2.
- Admin roles in your back-end do not substitute for identity-gated access at the network layer.
About the Speakers
Peter O’Neill is a Senior Solutions Engineer at Teleport, specializing in secure, scalable cloud-native infrastructure. With expertise in Kubernetes, DevOps, and zero-trust architectures, Peter delivers practical insights to help developers secure and optimize their engineering workflows.
Boris Kurktchiev is the Field CTO at Teleport and a lead for the CNCF AI Technical Coordination Group. In the world of tools, it’s not ‘one size fits all.’ He’s the expert who always knows when to grab the hammer and when to reach for the screwdriver.