Service Mesh Zero-Trust Architecture
A practical guide to building zero-trust applications on Istio
Jun 9, 202614 min read32
Command Palette
Search for a command to run...
Series
Zero-Trust Security on Istio
A deep walkthrough of building an end-to-end zero-trust security system on Istio. Each post focuses on one layer, the attack surface it addresses, the pattern that solves it, and real config from a working Kind cluster. Covers mTLS, signed mesh tokens, Envoy/ExtAuthz, Cerbos, PostgreSQL RLS, and Vault Transit signing.
The Identity Flow: From Gateway to Database
Tracing one request through eight checkpoints, from an Envoy header strip at the gateway to Postgres row-level security
Jul 6, 202615 min read11
Signing Mesh Tokens with Vault
Why the private signing key stays in Vault, how rotation avoids 403s, and the blast radius when a component is compromised
Jul 9, 202613 min read8