Implementing Zero-Trust Architecture with Service Mesh

Implementing Zero-Trust Architecture with Service Mesh

Zero-trust networking assumes no implicit trust between services, requiring explicit authorization for all communications. Service meshes enable zero-trust implementation through default-deny policies and explicit authorization rules. Every service must prove its identity and be authorized before accessing other services, regardless of network location.

Workload identity forms the foundation of zero-trust in service meshes. Rather than relying on network addresses, services authenticate using cryptographic identities. SPIFFE (Secure Production Identity Framework For Everyone) provides a standard for workload identity that many service meshes adopt. These identities remain consistent regardless of where workloads run, enabling portable security policies.

# Istio strict mTLS configuration
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

---
# Fine-grained authorization policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: frontend-to-backend
  namespace: production
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/v1/*"]
    when:
    - key: request.headers[x-request-id]
      values: ["*"]
  # Deny all other traffic (implicit with no catch-all ALLOW)

---
# Service-specific authorization with JWT validation
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-gateway
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
    when:
    - key: request.auth.claims[iss]
      values: ["https://auth.company.com"]
    - key: request.auth.claims[aud]
      values: ["api.company.com"]
    - key: request.auth.claims[exp]
      values: ["*"]

---
# RequestAuthentication for JWT validation
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-gateway
  jwtRules:
  - issuer: "https://auth.company.com"
    jwksUri: "https://auth.company.com/.well-known/jwks.json"
    audiences:
    - "api.company.com"
    forwardOriginalToken: true

Progressive security rollout enables gradual zero-trust adoption without disrupting existing services. Service meshes support permissive modes that monitor but don't enforce policies, allowing teams to understand traffic patterns before enforcement. This approach reveals unexpected dependencies and prevents service disruptions during zero-trust implementation.