The perimeter model treats the inside network as a safe zone. A compromised pod reaches the database, cache, and payment queue. NIST SP 800-207 defines zero trust as the principle of never trusting and always verifying, regardless of network position. Every call authenticates.

mTLS as the foundation

Mutual TLS requires certificates on both connection ends, proving identity before the first application byte. Service mesh automates certificate issuance and rotation through SPIFFE identities like spiffe://cluster/ns/payments/sa/api. Istio and Linkerd dominate this space. Cilium does the same job without sidecars.

Workload identity kills the shared key

AWS IRSA, GCP Workload Identity Federation, and Azure Managed Identities bind cloud IAM identity to pods without static credentials, as documented in their respective official pages. The API key replicated across ten services in environment variables disappears from the inventory. Each workload gets its own identity, individually revocable.

An application layer above transport

mTLS proves who speaks at the transport layer. Short-lived JWTs signed per request carry intent and authorization. The OAuth2 client credentials flow handles direct calls. Token exchange (RFC 8693) delegates in chains when the final service needs to know which original user started the operation.

Explicit authorization

  • Audit existing traffic first; teams discover undocumented calls
  • Run observability mode logging policy violations without blocking
  • Enable enforcement per namespace, starting with payment flows

OPA with Rego or mesh-native authorization policies codify which service may call which endpoint with which claims.

Operational realities

Certificate rotation failure takes production down. Rotation health alerting matters as much as mTLS itself. Debugging denied calls requires policy audit logs. Mesh latency overhead stays in single-digit milliseconds. Measure it in your scenario before promising numbers to a customer.

Where to start

List today which services talk to the database directly. If the answer is "all of them", your internal attack surface equals the whole cluster. The first namespace to migrate already picked itself.