<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-service-mesh-security
description: >-
  Audit service mesh security configurations including mTLS enforcement, RBAC
  policies, certificate management, and sidecar injection verification for
  Istio, Linkerd, and Consul Connect deployments.
domain: cybersecurity
subdomain: container-security
tags:
  - service-mesh
  - istio
  - linkerd
  - mtls
  - rbac
  - certificate-management
  - zero-trust
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557"]
---

# Auditing Service Mesh Security

## Overview

Service meshes provide mTLS, authorization policies, and observability at the
infrastructure layer. But misconfigurations — permissive mTLS modes, missing
authorization policies, overly broad RBAC — create blind spots. This skill
covers auditing Istio, Linkerd, and Consul Connect for mTLS enforcement gaps,
missing authorization policies, certificate expiration, and sidecar injection
coverage to validate zero-trust network posture.

Mode: `[MODE: BLUE]` — Defensive mesh configuration audit.

## Prerequisites

| Requirement | Details |
|---|---|
| Istio >= 1.20 or Linkerd >= 2.14 or Consul >= 1.17 | Required |
| istioctl, linkerd CLI, or consul CLI | Required |
| kubectl with cluster access | Required |
| Access to mesh control plane logs | Required |

## Key Concepts

### Istio mTLS Audit

```bash
# Check PeerAuthentication policies
kubectl get peerauthentication --all-namespaces -o yaml

# Check mesh-wide mTLS mode
kubectl get peerauthentication -n istio-system -o json | jq '
  .items[] | {name: .metadata.name, mtls: .spec.mtls.mode}'

# Verify mTLS between services
istioctl x authz check POD -n NAMESPACE

# Check if mTLS is STRICT everywhere
istioctl analyze --all-namespaces 2>&1 | grep -i "mtls\|authentication"
```

### Authorization Policy Audit

```bash
# List all AuthorizationPolicies
kubectl get authorizationpolicies --all-namespaces -o yaml

# Find namespaces without authorization policies
kubectl get namespaces -o json | jq -r '.items[].metadata.name' | while read ns; do
  count=$(kubectl get authorizationpolicies -n "$ns" --no-headers 2>/dev/null | wc -l)
  if [ "$count" -eq 0 ]; then echo "NO_AUTHZ: $ns"; fi
done

# Check for overly permissive rules
kubectl get authorizationpolicies -A -o json | jq '
  .items[] | select(.spec.rules == null or .spec.action == "ALLOW")
  | {namespace: .metadata.namespace, name: .metadata.name}'
```

### Istio Certificate Inspection

```bash
# Check sidecar certificate expiry
istioctl proxy-config secret POD -n NAMESPACE -o json | jq '
  .dynamicActiveSecrets[] | select(.name == "default") |
  .secret.tlsCertificate.certificateChain.inlineBytes' | \
  base64 -d | openssl x509 -noout -dates

# Check CA certificate
kubectl get secret istio-ca-secret -n istio-system -o jsonpath='{.data.ca-cert\.pem}' | \
  base64 -d | openssl x509 -noout -dates -subject
```

### Linkerd Security Audit

```bash
# Check mTLS status
linkerd check --proxy

# Verify identity certificates
linkerd identity -n NAMESPACE

# Check authorization policies
kubectl get serverauthorizations --all-namespaces
kubectl get authorizationpolicies --all-namespaces

# Edge statistics (traffic without mTLS)
linkerd edges deployment -n NAMESPACE
```

### Sidecar Injection Verification

```bash
# Check namespace injection labels
kubectl get namespaces -L istio-injection

# Find pods without sidecars
kubectl get pods --all-namespaces -o json | jq '
  [.items[] | select(
    (.spec.containers | length == 1) and
    (.metadata.namespace | test("istio-system|kube-system") | not)
  ) | {namespace: .metadata.namespace, pod: .metadata.name}]'
```

## Workflow

### Step 1: Audit mTLS Configuration

```bash
node scripts/agent.js --check-mtls --output /tmp/mtls-audit.json
```

### Step 2: Check Authorization Policies

```bash
node scripts/agent.js --check-authz --output /tmp/authz-audit.json
```

### Step 3: Verify Sidecar Coverage

```bash
node scripts/agent.js --check-sidecars --output /tmp/sidecar-audit.json
```

## Detection

```yaml
title: Auditing Service Mesh Security Detection
id: 2158b4ff-dce5-4900-8a89-d1f25a3e3ba0
status: experimental
description: Detects suspicious activity related to auditing service mesh security techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Service Mesh Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557 |

## Verification

- [ ] mTLS mode set to STRICT for all production namespaces
- [ ] No PERMISSIVE PeerAuthentication policies in production
- [ ] Authorization policies exist for all services
- [ ] No allow-all authorization policies without source restrictions
- [ ] Sidecar proxies injected in all application pods
- [ ] Control plane certificates not expiring within 30 days
- [ ] Mesh traffic encrypted end-to-end (no plaintext)

## References

- [Istio Security](https://istio.io/latest/docs/concepts/security/)
- [Linkerd Security](https://linkerd.io/2.14/features/automatic-mtls/)
- [Consul Connect Security](https://developer.hashicorp.com/consul/docs/connect)
- [CIS Kubernetes Benchmark — Service Mesh](https://www.cisecurity.org/benchmark/kubernetes)
- [NIST SP 800-204A — Service Mesh Security](https://csrc.nist.gov/publications/detail/sp/800-204a/final)
