- 01Service mesh mTLS handles workload identity and encryption — the easy half. The hard half is authorization: turning workload identity into an enforceable policy that says service A may call service B's /payments endpoint with a specific scope, and nothing else.
- 02What works: SPIFFE identities in every workload (auto-rotated), authorization-as-code (Istio AuthorizationPolicy / Cedar / OPA), default-deny with explicit allow per service-to-service call, and a denials feed into the SOC.
- 03Migration pattern that survives: shadow mode 4–8 weeks per service capturing denials as warnings; tune until the warning rate is steady; flip to enforce; repeat. Flipping a hundred services at once produces a war room and an outage.
- 04Non-HTTP east-west (databases, caches, queues) is weaker territory. Plan for sidecars, custom envoy filters, Vault Database Secrets Engine, and Kafka ACLs sourced from your IdP.
Service meshes (Istio, Linkerd, Consul) make mutual TLS between workloads almost trivial. That is not the hard part of east-west Zero Trust. The hard part is authorization: turning workload identity into an enforceable policy that says service A may call service B's /payments endpoint with a specific scope, and nothing else.
From identity to authorization
- 01SPIFFE identities in every workload, automatically rotated
- 02Authorization policies expressed in code (Istio AuthorizationPolicy, Cedar, OPA)
- 03Default-deny posture — explicit allow per service-to-service call
- 04Audit log of every denial, fed into the SOC
The migration pattern that works
Run the policy engine in shadow mode for 4–8 weeks per service. Capture denials as warnings, not blocks. Tune policies until the warning rate is steady. Flip to enforce. Repeat per service. Trying to flip a hundred services at once produces a war room and an outage.
Authorization for non-HTTP
Most service meshes do well on HTTP/gRPC. Database, cache, and message-queue authorization is weaker. Plan for sidecars or proxy patterns (envoy with custom filters, Vault Database Secrets Engine, Kafka ACLs sourced from your IdP) for non-HTTP east-west traffic.