Istio mTLS Configuration

Overview

This template configures strict mutual TLS (mTLS) using Istio’s PeerAuthentication and DestinationRule resources. By default, Kubernetes traffic between pods is unencrypted — any process on the network path can intercept and read communications. With Istio mTLS, every service-to-service connection is automatically encrypted and authenticated using X.509 certificates managed by Istio’s control plane.

Security threat addressed: Without mTLS, an attacker who compromises a single pod can perform man-in-the-middle attacks, sniff traffic between services, and steal credentials, tokens, and sensitive data transmitted between microservices.

When to use: Apply this template after installing Istio in your cluster. Start with PERMISSIVE mode for migration, then switch to STRICT mode once all services have Istio sidecars.

Threat Model

• Man-in-the-Middle prevention: mTLS ensures that both the client and server verify each other’s identity before exchanging data, blocking interception attacks.
• Traffic sniffing defense: All pod-to-pod traffic is encrypted with TLS 1.3, preventing network-level eavesdropping.
• Service identity verification: Each workload gets a SPIFFE identity (spiffe://cluster.local/ns/NAMESPACE/sa/SERVICE-ACCOUNT), ensuring only authorized services communicate.

MITRE ATT&CK:

• T1040 — Network Sniffing: Without encryption, attackers can capture sensitive data from internal traffic.
• T1557 — Adversary-in-the-Middle: Unencrypted traffic allows interception and modification of requests.

YAML Source

# PeerAuthentication — Enforce STRICT mTLS for the namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production  # ACTION REQUIRED: Change to your namespace
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  mtls:
    mode: STRICT  # Reject any non-mTLS traffic

---
# DestinationRule — Ensure clients use mTLS
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default-mtls
  namespace: production  # ACTION REQUIRED: Match namespace above
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  host: "*.production.svc.cluster.local"  # ACTION REQUIRED: Match namespace
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

---
# AuthorizationPolicy — Restrict access between services
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend-to-api
  namespace: production
  labels:
    app.kubernetes.io/name: k8s-security
    app.kubernetes.io/part-of: k8s-security-pro
    app.kubernetes.io/managed-by: k8s-security-pro
spec:
  selector:
    matchLabels:
      app: api-server
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/*"]

Deployment

1. Verify Istio is installed: kubectl get pods -n istio-system
2. Ensure the target namespace has sidecar injection: kubectl label namespace production istio-injection=enabled
3. Apply the templates: kubectl apply -f 21_istio_mtls.yaml
4. Verify mTLS is enforced: istioctl authn tls-check <pod-name> -n production

Verification

# Check PeerAuthentication status
kubectl get peerauthentication -n production

# Verify mTLS is active between services
istioctl proxy-config endpoint <pod-name>.production --cluster "outbound|80||api-server.production.svc.cluster.local"

# Test that non-mTLS traffic is rejected
kubectl exec -n production deploy/test-client -- curl -v http://api-server:80
# Should fail if client doesn't have Istio sidecar

Further Reading

• Kubernetes Network Policies: Complete Guide — Foundation for network security
• Implementing Zero Trust in Kubernetes — mTLS as part of zero trust
• Template 01: Default Deny Network Policy — Network layer foundation
• Template 14: Namespace Isolation — Complement mTLS with network policies
• Template 20: Complete 3-Tier Network Policy — Full network segmentation