Lightning Talk: Using Keycloak Authorization Service for Kubernetes Service-to-Service… H. Özkan

Halil Özkan presents a pattern for using Keycloak Authorization Services as a centralized control plane for Kubernetes service-to-service authorization.

Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io Lightning Talk: Using Keycloak Authorization Service for Kubernetes Service-to-Service Authorization - Halil Özkan, Keymate Modern Kubernetes environments often centralize identity but still leave service-to-service authorization spread across application code, gateway rules, and proxy-specific configuration. This session presents a practical pattern for using Keycloak Authorization Services as a centralized authorization control plane while enforcing decisions at the platform layer instead of inside each application. The talk shows how Kubernetes workloads can remain unchanged while a mesh-level Policy Enforcement Point evaluates HTTP requests using workload identity, request metadata, and centrally managed policy. The architecture uses Istio Ambient mode, waypoint proxies, a WebAssembly-based enforcement extension, and a Keycloak-backed decision flow. The session also covers allow and deny behavior, fail-closed handling, bypass-prevention requirements, observability with OpenTelemetry, and the latency and reliability trade-offs that appear when Keycloak participates in the live authorization path. A live demo shows both the enforcement path and the operational signals it produces.