Cloud AI

Service meshes like Istio provide a dedicated infrastructure layer for handling service-to-service communication. They enable zero trust networking by implementing mutual TLS, fine-grained access control, and observability without changing application code.

Zero Trust Principles in Service Mesh

• Never Trust, Always Verify: Authenticate every request
• Least Privilege Access: Explicit authorization policies
• Assume Breach: Encrypt all traffic, even internal
• Continuous Verification: Real-time policy enforcement

Istio mTLS Configuration

# Enable strict mTLS mesh-wide
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

Authorization Policies

# Allow only specific services to access the API
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-access
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-gateway
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/v1/*"]
    when:
    - key: request.headers[x-api-version]
      values: ["v1", "v2"]

JWT Authentication

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-gateway
  jwtRules:
  - issuer: "https://auth.company.com"
    jwksUri: "https://auth.company.com/.well-known/jwks.json"
    audiences:
    - "api.company.com"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-gateway
  action: DENY
  rules:
  - from:
    - source:
        notRequestPrincipals: ["*"]

Network Policies

# Kubernetes NetworkPolicy for defense in depth
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

Observability for Security

# Istio telemetry for security monitoring
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: security-logging
  namespace: istio-system
spec:
  accessLogging:
  - providers:
    - name: envoy
    filter:
      expression: "response.code >= 400 || connection.mtls == false"

Best Practices

• Start with permissive mode, then migrate to strict mTLS
• Use deny-by-default authorization policies
• Implement rate limiting at the mesh level
• Monitor certificate expiration and rotation
• Combine with Kubernetes NetworkPolicies for defense in depth

Conclusion

Service meshes are essential for implementing zero trust networking in microservices architectures. By leveraging Istio’s security features, organizations can achieve strong authentication, authorization, and encryption without modifying application code.