Scaling Trust: Building Multi-Region mTLS for Keycloak

When your Keycloak clusters span multiple regions, mutual TLS (mTLS) becomes both your best friend and your worst nightmare.
Between certificate rotation, CRL management, and service-to-service trust, a single misconfiguration can isolate an entire region.

In this talk, I’ll walk through how we built and automated a multi-region Keycloak setup with mTLS at scale, securing communication across private and public networks while keeping latency and operational overhead under control.

I’ll talk about:
• What mTLS is and why it’s critical in modern IAM setups
• How Certificate Revocation Lists (CRL) work and why they matter
• How to configure Keycloak to use both mTLS and CRL validation
• The complexities of multi-region architectures:
• Active-active vs. active-passive (our case)
• Observability: how to detect, debug, and monitor broken trust chains
• A live demo showing how certificate revocation and renewal propagate across regions

You’ll leave with a step-by-step understanding of mTLS and CRL setup for Keycloak, plus practical strategies to keep your cross-region identity infrastructure both secure and resilient.

The New Realities of SaaS: Why Building is Harder Than Ever

We’ll start by looking back at a time when building SaaS felt easier, when you could focus on the product itself without worrying about regulations, ecosystems, or global incidents. Through real stories, timelines, and a few memes, we’ll trace how the industry changed and how new “leads”, from big platforms to demanding clients, are reshaping the relationship between provider and customer. Along the way, we’ll try to understand what these shifts tell us about the next chapter of SaaS.

This talk explores how those changes are redefining what “minimum” means in an MVP. We’ll look at what tools, frameworks, and strategies can help create a new product in today’s landscape, how the current hype is shaping the way we build, and how it can be used to our advantage, not only through AI, but also through open-source.

The Paradox of Open Source: Open Code, Closed Doors

Open source was built on the promise of openness, freedom to use, study, and improve.

However, somewhere between GitHub, DevOps, and the cloud, “open” became synonymous with “for developers only.”

This session looks at how open source grew from a rebellious idea of collective creation into the foundation of modern software and how that success quietly narrowed who gets to take part. We’ll go back to where it all started, from GNU and Linux to the rise of GitHub, to see how the tools that made global collaboration possible also decided who gets to take part.

We’ll talk about why roles like UX, product, and documentation still sit on the sidelines of open source, even though they shape how people actually experience it. With real stories like Keycloak’s tough onboarding or Grafana’s more welcoming approach we’ll look at how usability became the missing piece, and how better design could finally make open source feel open again.

You will leave with a new perspective on open collaboration and practical ideas for how designers, developers, and maintainers can bridge the gap between code and experience.

When Even AI Writes the CVE

We used to treat every CVE as an alert… That works when a serious vulnerability is a monthly event. It doesn't anymore. In 2025 the Linux kernel was the single most-reported product on the planet, with thousands of CVEs, roughly ten every day, from one project. And its maintainers don't even rank them by severity, so you can't wait for the "important" ones. Then the AI era poured fuel on the fire: 2026 is on track for 66,000 CVEs, and a single AI model (Claude Mythos) recently surfaced thousands of high-severity flaws that remain 99% unpatched. The flood is now machine-speed.

When a CVE lands every few minutes, you can't sound the alarm every time. So we stopped. Today patching is just part of the workflow, and we fight AI with AI: automation ingests and rolls out the patches, while AI triages the flood down to what is actually exploitable for each deployment. This talk shows how a small team keeps hundreds of Keycloak clusters and thousands of vulnerabilities under control, everywhere and anytime, without adding a single delay to the roadmap.

Preferred duration: 45 minutes. an expandable 60-minute version is available.

Target audience: DevOps, platform, SRE and security engineers who run open-source software in production, and anyone responsible for keeping systems patched at scale. Intermediate level. Assumes basic familiarity with CI/CD and what a CVE is; no Keycloak knowledge required.