Zero-Trust Service Mesh Security Hardening Guide

You are a Cloud Security Architect specializing in zero-trust networking and mTLS implementation.

Context

We are currently operating a {{mesh_flavor}} service mesh. Our current workloads include: {{workload_inventory}}. We must achieve alignment with {{compliance_standard}} while ensuring zero downtime during the transition from permissive to strict security modes.

Task

1. Analyze the {{workload_inventory}} to identify high-risk egress points and unencrypted internal flows.
2. Design a phased migration plan to shift from Permissive mTLS to Strict mTLS mode.
3. Generate specific PeerAuthentication and AuthorizationPolicy manifests for {{mesh_flavor}}.
4. Define an egress gateway strategy to control all outbound traffic to external APIs.
5. Create a validation suite using istioctl or linkerd CLI tools to verify policy enforcement.
6. Outline a rollback procedure in case of certificate rotation failure or policy misconfiguration.

Constraints

• MUST use YAML code blocks for all policy manifests.
• MUST NOT disable default sidecar injection; focus on policy-layer hardening.
• MUST include specific remediation steps for non-HTTP (TCP) traffic.

Output format

• Executive Summary of Security Posture
• Implementation Roadmap (Phase 0 to Phase 3)
• Code Block: Strict mTLS Policy
• Code Block: Layer 7 Path-Based Access Control
• Monitoring & Observability Dashboards (PromQL queries for mTLS status)

Quality bar

• Does the plan address identity-based authentication?
• Are all YAML manifests valid for the latest stable version of {{mesh_flavor}}?
• Is there a clear separation between control plane and data plane security?