Demo: replacing network-based trust with workload identity
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
remove a rule that trusts anything inside the network and replace it with identity checks; prepares SRB-016-LAB1.
Draft outline details
Step by step
- Find the rule: the stock service accepts any call from the internal subnet.
- Inventory callers using traffic logs, so you know who relies on it.
- Issue workload identities to the callers and add authentication in report-only mode.
- Planned mistake: switch to enforce mode at once and break an unlisted caller. Fix: watch the report-only results, fix gaps, then enforce with a rollback path.
- Remove the network allow rule and verify an unauthenticated call is denied.
- Record the change and monitor denials.
Check your understanding
Why start in report-only mode?
Show answer
It shows unknown callers before enforcement breaks them.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.