L12. Service Mesh and mTLS with Istio

Why a Service Mesh?

Network Policies operate at L3/L4 (IP addresses and ports). But modern applications need L7 controls: allow GET /health but block POST /admin. They also need encryption in transit, identity-based authorization, and observability.

A service mesh provides all of this by injecting a sidecar proxy (Envoy) into every pod.

How Istio Works

Istio consists of two parts:

• Data plane: Envoy sidecar proxies injected into every pod that intercept all network traffic
• Control plane: istiod, which configures the proxies with routing rules, security policies, and certificates

When you enable sidecar injection for a namespace, Istio automatically injects an Envoy proxy container into every new pod:

kubectl label namespace production istio-injection=enabled

Mutual TLS (mTLS)

mTLS means both the client and server present certificates and verify each other's identity. Istio automates this entirely:

1. istiod acts as a Certificate Authority and issues short-lived certificates to every sidecar
2. Sidecars automatically encrypt all pod-to-pod traffic
3. Certificates are rotated automatically (default every 24 hours)

Enable strict mTLS for a namespace:

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: strict-mtls
  namespace: production
spec:
  mtls:
    mode: STRICT

In STRICT mode, plaintext connections are rejected. PERMISSIVE mode allows both plaintext and mTLS (useful during migration).

Authorization Policies

Istio authorization policies provide L7 access control based on service identity:

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: api-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: api
  rules:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">from:</li>
<li class="text-slate-300">source:</li>
</ul>
            principals: ["cluster.local/ns/production/sa/web"]
      to:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">operation:</li>
</ul>
            methods: ["GET", "POST"]
            paths: ["/api/v1/*"]

This allows only the web service account to call GET and POST on /api/v1/* paths of the api service. The identity is cryptographically verified through mTLS certificates.

Ambient Mesh

Istio's Ambient mode (GA in Istio 1.24) eliminates sidecar proxies by using per-node ztunnel agents for L4 mTLS and optional waypoint proxies for L7 policies. This reduces resource overhead and operational complexity.

Alternatives

Cilium's eBPF approach is gaining traction because it avoids sidecar overhead and integrates natively with the CNI layer.