TL;DR: A reverse tunnel lets a control plane reach into clusters it can't connect to — but only if you can trust who's dialing in. This talk shows how we authenticated Envoy reverse tunnels with JWT.

When your control plane runs in the cloud and data planes run in customers' clusters, traffic only flows outward — you can't reach in to reload config, revoke credentials, or debug live. Envoy's reverse tunnels invert that: the data plane dials out and the control plane sends requests back down. The catch is trust: the extension has no built-in auth. We authenticate every handshake with JWT (jwt_authn + remote_jwks), reusing identities the data plane already has.

Schedule:
- Intro — 2 min
- How reverse tunnels work — 2 min
- The trust problem — 2 min
- Authenticating with JWT — 2 min
- Q&A — 2 min