<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Service Mesh Security — API Reference

## istioctl Commands

```bash
istioctl analyze --all-namespaces
istioctl x authz check POD -n NAMESPACE
istioctl proxy-config secret POD -n NAMESPACE
istioctl proxy-status
istioctl dashboard controlz
```

## Istio CRDs

| CRD | Purpose |
|-----|---------|
| `PeerAuthentication` | mTLS configuration |
| `AuthorizationPolicy` | L7 access control |
| `RequestAuthentication` | JWT validation |
| `DestinationRule` | TLS settings per service |
| `Sidecar` | Proxy scope configuration |

## kubectl Mesh Commands

```bash
kubectl get peerauthentication -A -o yaml
kubectl get authorizationpolicies -A -o yaml
kubectl get destinationrules -A -o yaml
kubectl get requestauthentication -A -o yaml
kubectl get namespaces -L istio-injection
```

## Linkerd CLI

```bash
linkerd check --proxy
linkerd identity -n NAMESPACE
linkerd edges deployment -n NAMESPACE
linkerd viz stat deploy -n NAMESPACE
kubectl get serverauthorizations -A
```

## Consul CLI

```bash
consul intention list
consul intention check SOURCE DESTINATION
consul connect ca get-config
consul members
```

## mTLS Modes

| Mode | Description | Risk |
|------|-------------|------|
| `STRICT` | Require mTLS | Low |
| `PERMISSIVE` | Accept both mTLS and plaintext | High |
| `DISABLE` | No mTLS | Critical |
| `UNSET` | Inherit from parent | Varies |
