<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: securing-service-mesh
description: >-
  Secure service mesh deployments including Istio and Linkerd by configuring
  mTLS, authorization policies, traffic encryption, certificate management,
  and observability for zero-trust service-to-service communication in Kubernetes.
domain: cybersecurity
subdomain: container-security
tags:
  - service-mesh
  - istio
  - linkerd
  - mtls
  - zero-trust
  - authorization-policy
  - certificate-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557"]
---

# Securing Service Mesh

## Overview

Service meshes provide a dedicated infrastructure layer for service-to-service
communication with built-in security features. This skill covers configuring
mutual TLS (mTLS) for all mesh traffic, implementing fine-grained authorization
policies, managing certificate rotation, auditing mesh configurations for
security gaps, and monitoring mesh traffic for anomalous patterns.

Mode: `[MODE: ARCHITECT]` — Zero-trust architecture with `[MODE: BLUE]` monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| Istio >= 1.20 or Linkerd >= 2.14 installed on Kubernetes cluster | Required |
| `istioctl` or `linkerd` CLI installed | Required |
| Understanding of Kubernetes service networking | Required |
| cert-manager for external certificate management (optional) | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/securing-service-mesh-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/securing-service-mesh-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/securing-service-mesh-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Securing Service Mesh Detection
id: b20921cb-af47-4cda-822f-4d00fb2b62ff
status: experimental
description: Detects suspicious activity related to securing service mesh techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Securing Service Mesh Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Istio Security](https://istio.io/latest/docs/concepts/security/)
- [Istio Authorization Policy](https://istio.io/latest/docs/reference/config/security/authorization-policy/)
- [Linkerd Security](https://linkerd.io/2/features/automatic-mtls/)
- [NIST SP 800-204A — Service Mesh Security](https://csrc.nist.gov/publications/detail/sp/800-204a/final)
