Advanced Patterns and Techniques

Service Mesh Security

Zero Trust with Service Mesh

Implementing zero trust architecture:

Service Mesh Security Features:

• Mutual TLS (mTLS)
• Fine-grained access control
• Traffic encryption
• Certificate management
• Authentication and authorization
• Traffic monitoring
• Security policy enforcement

Zero Trust Principles:

• Never trust, always verify
• Least privilege access
• Explicit verification
• Continuous monitoring
• Microsegmentation
• Strong authentication
• Dynamic policy enforcement

Example Istio Authorization Policy:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payment-service-policy
  namespace: payment
spec:
  selector:
    matchLabels:
      app: payment-service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/checkout/sa/checkout-service"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/payments"]
  - from:
    - source:
        principals: ["cluster.local/ns/accounting/sa/accounting-service"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/api/payments/*"]

mTLS Implementation:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

Service-to-Service Security

Securing microservices communications:

Service Identity:

• SPIFFE-based identities
• Certificate-based authentication
• Workload identity federation
• Identity bootstrapping
• Identity rotation
• Identity attestation
• Identity-based authorization

Traffic Encryption:

• End-to-end encryption
• Protocol-specific encryption
• TLS configuration
• Cipher suite selection
• Certificate management
• Key rotation
• Perfect forward secrecy

Access Control:

• Service-level authorization
• Path-based authorization
• Method-based authorization
• Header-based authorization
• JWT validation
• Rate limiting
• Circuit breaking

DevSecOps for Cloud-Native

Shifting Security Left

Integrating security into the development lifecycle:

DevSecOps Integration Points:

• IDE security plugins
• Pre-commit hooks
• Automated code reviews
• CI/CD pipeline security
• Infrastructure as code scanning
• Container image scanning
• Dependency scanning
• Compliance validation

Example CI/CD Security Pipeline:

# GitLab CI/CD pipeline with security stages
stages:
  - build
  - test
  - security
  - deploy

build:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

unit_tests:
  stage: test
  script:
    - docker run $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA npm test

sast:
  stage: security
  script:
    - semgrep --config=p/owasp-top-ten .

dependency_scanning:
  stage: security
  script:
    - trivy fs --security-checks vuln,config .

container_scanning:
  stage: security
  script:
    - trivy image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

iac_scanning:
  stage: security
  script:
    - checkov -d ./kubernetes

deploy:
  stage: deploy
  script:
    - kubectl apply -f kubernetes/
  only:
    - main

Security as Code Tools:

• Static application security testing (SAST)
• Software composition analysis (SCA)
• Dynamic application security testing (DAST)
• Infrastructure as code scanning
• Container image scanning
• Secret scanning
• Compliance as code