Training Course Professional

PQC Migration for Cloud-Native Applications and Service Mesh Infrastructure

Migrating mTLS, service mesh encryption, and API gateway cryptography to post-quantum standards.

Full day (6 hours)
Certificate on completion
Enquire About This Course View Curriculum

Proud to recommend our expert members

Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence
Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence

Course Overview

Technical workshop for platform engineering and cloud security teams. Covers PQC integration in Kubernetes-native environments: Istio and Linkerd service mesh mTLS migration, cert-manager PQC certificate provisioning, SPIFFE/SPIRE workload identity under post-quantum standards, container image signing with Sigstore using PQC algorithms, and performance engineering for high-throughput microservice environments.

Curriculum

Course content is structured into sessions below. Each session is configurable to your organisation's environment, threat model, and objectives.

# Session Topics
1 The Quantum Threat to Cloud-Native Infrastructure Why service mesh mTLS and workload identity are early PQC migration targets
2 Service Mesh mTLS Migration PQC certificate provisioning for Istio and Linkerd
  • Istio mTLS: Citadel CA PQC certificate issuance, Envoy proxy TLS 1.3 hybrid mode support, and sidecar performance impact of ML-KEM handshakes
  • Linkerd mTLS: identity controller PQC integration and trust anchor rotation with hybrid certificates
  • Certificate size impact: ML-KEM-768 and ML-DSA-65 certificate sizes versus ECDSA P-256 and implications for proxy memory and handshake latency at scale
Break
3 Workload Identity and Certificate Management SPIFFE/SPIRE PQC integration and cert-manager provisioning
  • SPIFFE/SPIRE: PQC SVID issuance, workload attestation with hybrid certificates, and federation across trust domains
  • cert-manager: PQC certificate provisioning with Issuer and ClusterIssuer resources, integration with Vault and AWS PCA for PQC root CAs
  • Certificate lifecycle: automated rotation intervals for larger PQC certificates, OCSP and CRL scaling considerations
4 Supply Chain Security Under PQC Container image signing and software attestation with post-quantum algorithms
  • Sigstore/Cosign: PQC signature support for container image signing and verification in admission controllers
  • SLSA provenance: PQC signatures on build attestations and the SLSA v1.0 specification implications
  • OCI registry compatibility: handling larger PQC signatures in manifest layers and registry storage overhead
Break
5 Performance Engineering and Migration Sequencing Managing the performance cost of PQC in high-throughput microservice environments
  • Handshake latency budgets: ML-KEM-768 key encapsulation adds approximately 0.5ms per handshake versus ECDH P-256. At 10,000 inter-service connections per second, the aggregate impact requires capacity planning.
  • Certificate size and bandwidth: ML-DSA-65 certificates are approximately 2.5 KB versus 300 bytes for ECDSA. Impact on Envoy sidecar memory at scale.
  • Migration sequencing: ingress gateway first, then east-west mTLS, then supply chain signing. Rollback procedures for each phase.
6 Standards, Compliance, and Vendor Landscape Regulatory drivers and tooling readiness
  • NIST FIPS 203/204/205 finalisation and CNSA 2.0 compliance deadlines for cloud-native environments
  • NIST SP 800-204 series (microservices security) and PQC alignment considerations
  • Vendor readiness: Kubernetes distribution PQC support across managed (EKS, AKS, GKE) and self-managed clusters
7 Q&A and Migration Planning

Designed and Delivered By

Training courses are designed and delivered by QSECDEF in collaboration with subject specialists. All instructors have direct experience in quantum technologies and security.

QD

Quantum Security Defence

Course design and delivery

QSECDEF brings expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our membership spans 900+ organisations and 1,500+ professionals working at the intersection of quantum technologies and critical infrastructure security.

Enquire About This Course

Get in touch to discuss scheduling, group pricing, and how this course can be configured to your organisation's needs.

Contact Us
Training Courses Consulting Services Training