Module 7: Service Mesh Security Slides

Slide Outline

1. Service Mesh Security - Envoy, Istio, and Linkerd — transparent mTLS, identity propagation, and authorization policies
2. Learning Objectives - 4 outcomes for this module
3. Why This Module Matters - Service meshes are the most practical way to deploy zero trust at scale. Instead of modifying every application to handl
4. Service Mesh Security Capabilities - Lesson section from the full module
5. Istio Security Model - Lesson section from the full module
6. Real-World Use Cases - Transparent mTLS for all east-west traffic, Identity-based authorization in Istio
7. Common Mistakes to Avoid - 4 mistakes covered
8. Hands-On Labs - 2 hands-on labs
9. Key Takeaways - 5 points to remember

Learning Objectives

• Understand service mesh architecture and security capabilities
• Deploy Istio with mTLS enforcement
• Configure identity-aware authorization policies
• Integrate SPIRE as the mesh identity provider

Why This Module Matters

Service meshes are the most practical way to deploy zero trust at scale. Instead of modifying every application to handle mTLS, the mesh proxy handles it transparently. This module teaches you to deploy and configure the encryption and authorization layer for production Kubernetes.

Common Mistakes

• Enabling permissive mTLS instead of strict — allows plaintext fallback
• Not testing AuthorizationPolicies before enforcing — blocks legitimate traffic
• Running service mesh without understanding resource overhead (CPU, memory per sidecar)
• Deploying mesh without SPIRE — default Istio CA uses weaker attestation

Key Takeaways

• Service meshes provide transparent mTLS — no application code changes
• Envoy sidecars handle encryption, authentication, and authorization
• Istio PeerAuthentication enforces mTLS, AuthorizationPolicy enforces access
• SPIRE can replace Istio CA for stronger workload attestation
• Service mesh + SPIFFE = the infrastructure layer of zero trust

Hands-On Labs

1. Deploy Istio with Strict mTLS

   Enable automatic encryption for all service traffic.

   35 min - Intermediate

   • Install Istio with default profile
   • Enable sidecar injection
   • Deploy sample application
   • Enforce strict mTLS and verify encryption

   View lab files on GitHub

2. Configure Identity-Based Authorization

   Restrict service access based on SPIFFE identities.

   30 min - Intermediate

   • Create AuthorizationPolicy resources
   • Allow only specific services to access database
   • Test that unauthorized services are rejected (403)
   • View access logs in Envoy

   View lab files on GitHub