Zero trust networking assumes no implicit trust based on network location. Every connection must be authenticated, authorized, and encrypted. Here’s how to implement it in Kubernetes.
Zero Trust Principles
- Never trust, always verify
- Assume breach
- Verify explicitly
- Least privilege access
Implementation Layers
Layer 1: Network Policies
Start with default deny:
YAML
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: production
spec:
podSelector: {}
policyTypes:
- Ingress
- EgressThen allow specific traffic:
YAML
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-api
spec:
podSelector:
matchLabels:
app: api
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- port: 8080Layer 2: Service Mesh mTLS
Deploy Istio with strict mTLS:
YAML
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: default
namespace: istio-system
spec:
mtls:
mode: STRICTLayer 3: Authorization Policies
Define who can call what:
YAML
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: api-authz
spec:
selector:
matchLabels:
app: api
action: ALLOW
rules:
- from:
- source:
principals: ["cluster.local/ns/prod/sa/frontend"]
to:
- operation:
methods: ["GET"]
paths: ["/api/public/*"]
- from:
- source:
principals: ["cluster.local/ns/prod/sa/admin"]
to:
- operation:
methods: ["*"]Layer 4: Workload Identity
Use SPIFFE/SPIRE for workload identity:
YAML
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
name: api-identity
spec:
spiffeIDTemplate: "spiffe://example.org/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
podSelector:
matchLabels:
app: apiMicro-Segmentation
Break your network into small segments:
PLAINTEXT
Internet → Ingress → Frontend → API → Database
↓ ↓ ↓ ↓ ↓
(WAF) (AuthN) (AuthZ) (mTLS) (Encrypt)Monitoring Zero Trust
- Log all connection attempts
- Alert on denied connections
- Track identity verification failures
- Monitor certificate expiration
Zero trust takes effort but dramatically improves your security posture.