Addressing protocol security gaps in multi-tenant Kubernetes

This article describes an architecture for securing unauthenticated protocols in multi-tenant Amazon EKS clusters using namespace-scoped mTLS gateways, managed TURN relay, and JWT identity chains.

• Protocols like ADB and WebRTC lack built-in encryption and enterprise authentication; pods can reach other tenants' ports by default
• Previous bastion-host approach created latency bottlenecks; ADB commands took 1–2 seconds and installs took 3–4 minutes
• Namespace-scoped Envoy Gateway with mTLS certificates issued by AWS Private CA authenticates connections per namespace
• Kinesis Video Streams provides managed TURN relay for WebRTC, replacing self-managed STUNner infrastructure
• JWT identity chain validates users against enterprise IdP; custom API logs authenticated identity, namespace, and timestamp
• Short-lived 12-hour certificates with automatic rotation via cert-manager reduce exposure from compromised credentials
• New architecture achieves under 50 ms gateway latency; ADB commands complete in under 100 ms and installs in under 30 seconds
• Pattern applies to VNC, RDP, MQTT, SIP and other TCP protocols lacking encryption or authentication

The reusable components—mTLS gateways, certificate rotation, and managed relay—enable securing unauthenticated protocols on shared clusters without protocol modification.