Reactive Identity and Access Control in Container Environments Based on Envoy Proxy Server

Abstract

In containerized and microservice systems, access is increasingly granted not to a single request, but to a long-lived HTTP/2 (gRPC, Google Remote Procedure Call) stream. In such a context, authorization only at the moment a connection is opened does not guarantee timely termination of access after a revocation event. We present a reactive identity and access management mechanism implemented for a service mesh based on the Envoy proxy server. The local identity provider publishes OIDC (OpenID Connect) and JWKS (JSON Web Key Set) metadata and issues an access token with the sub, sid, and jti fields—that is, the subject, session, and token identifiers. This ensures that all end-user scenarios use the same authentication approach, and comparisons do not rely on pre-defined identifiers. Envoy accepts standardized Shared Signals Framework (SSF) and Continuous Access Evaluation Profile (CAEP) events in the Security Event Token (SET) format, normalizes subject, session, and token identifiers (sub, sid, jti), stores the denied state in Redis, and specifically terminates an active gRPC flow in the Envoy data plane. For evaluation, a reproducible Kubernetes rig was built with a single local identity provider publishing OIDC/JWKS metadata and compared against three open-source architectures: OPA (Open Policy Agent) + Envoy, Istio CUSTOM with Istio's external authorization mode enabled, and OpenFGA. The main series includes 360 runs: four architectural approaches, three load profiles, and 30 iterations per configuration. The developed approach terminated the active thread in all iterations, ensured complete blocking of reopening after access revocation, and kept the risk window at 0 messages in the low and medium profiles and approximately 0.9 messages in the high profile, while the compared architectures only blocked reopening. The practical significance of this work lies in the reproducible method for translating standardized security events into immediate policy enforcement at the network proxy level.