> Markdown version of [/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications?t=1211](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications?t=1211). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Get started with securing your cloud-native Java microservices applications

Stop writing boilerplate code to secure your Java microservices. Discover how Quarkus, Keycloak, and Istio seamlessly automate zero-trust network policies without modifying your core business logic.

- **Speakers:** Thomas Südbröcker
- **Event:** WeAreDevelopers LIVE
- **Published:** March 23, 2021
- **Duration:** 1:48:32
- **URL:** https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications

## Summary

Securing cloud-native Java applications requires a comprehensive approach that targets both the application logic and the underlying hosting platform. The application layer focuses on identity and access management using Keycloak to implement standard protocols like OpenID Connect and OAuth 2.0. By leveraging modern enterprise Java frameworks like Quarkus and Eclipse MicroProfile, developers can seamlessly secure RESTful endpoints and extract JSON Web Token (JWT) claims. A critical insight here is that the MicroProfile Rest Client drastically simplifies service-to-service communication by automatically propagating authentication headers, preventing developers from having to write repetitive boilerplate code to pass tokens between distributed microservices.

Beneath the application code, the platform layer utilizes Kubernetes paired with the Istio service mesh to control network traffic. Istio architecture fundamentally changes how security is applied by injecting Envoy sidecar proxies into every pod, decoupling security policies from the underlying business logic. This allows operators to manage external TLS certificates (via Let's Encrypt) at the ingress gateway and enforce Mutual TLS (MTLS) for all internal pod-to-pod communication. Enforcing strict MTLS ensures that only trusted, authenticated services can interact, effectively neutralizing unauthorized internal access attempts without requiring code modifications.

A core takeaway is that security must be integrated at the very start of the development lifecycle, adopting a multi-dimensional strategy that prevents vulnerabilities before deployment. When shifting authorization checks to the platform layer via service mesh policies, applications must still implement proper fallback mechanisms to gracefully handle blocked requests that are dropped before ever reaching the application tier. Finally, utilizing observability tools like Kiali is essential for visually mapping service mesh traffic, providing transparent validation that routing rules, load balancing, and zero-trust security policies are functioning exactly as intended.

**Keywords:** cloud-native java microservices, kubernetes platform security, istio service mesh setup, keycloak identity management, openid connect integration, jwt token propagation, quarkus java framework, eclipse microprofile rest client, mtls enforcement, kubernetes ingress gateways, envoy sidecar proxies, internal traffic authorization, kiali traffic visualization, role-based access control, container vulnerability scanning

## Chapters

1. **Demo of the secured cloud-native application** (00:52) — End-to-end demonstration of a secured article application running on Kubernetes.
1. **Cloud native starter project architecture** (02:51) — Overview of a basic cloud-native architecture combining Vue front ends with reactive security.
1. **Implementing IAM with Keycloak and OpenID Connect** (05:34) — Modernizing decentralized authentication securely utilizing OAuth 2 standard protocols and token formats.
1. **Utilizing Quarkus for Kubernetes native Java** (08:26) — Optimizing native compilations in Java specifically tuned for lightweight Kubernetes deployments.
1. **Building restful microservices with Eclipse MicroProfile** (10:08) — Extending Jakarta EE standards specifically targeting efficient restful service orchestration.
1. **Authentication workflow and Keycloak realm configuration** (12:22) — Intercepting client requests to establish identity realms, role definitions, and appropriate front end redirects.
1. **Processing JSON web tokens in the front end** (16:04) — Extracting access tokens and decoding payload claims directly from the JavaScript SDK.
1. **Protecting Java microservices with role-based access** (20:11) — Securing backend REST endpoints by automatically forwarding and validating authentication headers via MicroProfile constructs.
1. **Platform security fundamentals using Istio service mesh** (24:05) — Intercepting cross-cluster communications by proxying traffic via transparent Envoy sidecars to enforce ingress limits.
1. **Enforcing mutual TLS and routing within Istio** (30:30) — Isolating workloads explicitly by encrypting peer-to-peer traffic and ensuring complete zero trust observability.
1. **Accessing the cloud shell and Kubernetes cluster** (37:18) — Leveraging managed Kubernetes services and browser-based interfaces to eliminate local prerequisite configurations.
1. **Cloning repository and preparing cloud terminal** (47:54) — Provisioning workspace environment variables and handling git sources securely within the cloud console window.
1. **Installing Istio programmatically with bash scripts** (54:54) — Automating service mesh deployments by executing bash pipelines to bootstrap required Kubernetes control elements.
1. **Configuring TLS certificates for external ingress gateways** (62:09) — Injecting DNS secrets directly into the Istio namespace to activate authorized Let's Encrypt certificates.
1. **Initializing Keycloak and creating identity management realms** (76:11) — Injecting automated authentication states by provisioning the cluster user directory via API uploads.
1. **Deploying article services and front end config maps** (81:52) — Exposing containerized backing services connecting unified API routes via Kubernetes primitives smoothly.
1. **Validating internal zero trust with strict mutual TLS** (89:14) — Emulating unauthorized access attempts to confirm strict mesh policies safely terminate unencrypted connections.
1. **Restricting internal access using service account policies** (95:47) — Replacing permissive mesh identities to lock HTTP operations by strictly enforcing dedicated API service accounts.
1. **Observing microservice traffic telemetry with Kiali** (104:27) — Visualizing explicit mesh routing flows to detect anomalies while actively inspecting live cluster components.

## Related Moments

- [Technology stack for building robust microservices applications](https://www.wearedevelopers.com/videos/89-development-of-reactive-applications-with-quarkus) (from "Development of reactive applications with Quarkus")
- [Introduction to Kubernetes security challenges and opportunities](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Introduction to cloud-native application developer security](https://www.wearedevelopers.com/videos/416-capture-the-flag-101) (from "Capture the Flag 101")
- [Understanding the four Cs of cloud native security](https://www.wearedevelopers.com/videos/1411-kubernetes-security-best-practices) (from "Kubernetes Security Best Practices")
- [Deploying native Quarkus applications to a Knative cluster](https://www.wearedevelopers.com/videos/243-serverless-native-java-with-quarkus) (from "Serverless-Native Java with Quarkus")
- [Utilizing pre-integrated observability and authentication platform tools](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) (from "DevSecOps: Security in DevOps")

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Learning Kubernetes made easy with KubeCampus](https://www.wearedevelopers.com/magazine/348-learning-kubernetes-made-easy-with-kubecampus)
- [Security Basics for Vibe Coders](https://www.wearedevelopers.com/magazine/598-security-basics-for-vibe-coders)

## Related Jobs

- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Platform Engineer - Mercury Runtime Platform](https://www.wearedevelopers.com/jobs/ext/293235-platform-engineer-mercury-runtime-platform) at **Raiffeisen Bank International AG**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Staff Engineer, Security Engineering Partners](https://www.wearedevelopers.com/jobs/ext/1187268-staff-engineer-security-engineering-partners) at **Twilio**
- [Software Engineer, Platform Engineering (L2)](https://www.wearedevelopers.com/jobs/ext/1956829-software-engineer-platform-engineering-l2) at **Twilio**
- [Senior Backend Engineer (Java)](https://www.wearedevelopers.com/jobs/ext/19369-senior-backend-engineer-java) at **Bonial International GmbH**