Zero-trust principle
No implicit trust inside VPC. Every request authenticated and authorized — identity, not network location.
Legacy: "inside firewall = safe." Modern: compromised pod can reach anything.
mTLS everywhere
Service mesh provides workload mTLS via SPIFFE IDs. Apps don't manage certs.
Verify: client cert CN/SAN matches expected service identity.
OAuth2 client credentials
Service A calls Service B with client_id + secret or JWT assertion → access token for B's API.
Use when mesh mTLS insufficient (cross-cloud, legacy HTTP).
Rotate secrets via vault; short-lived tokens.
Kubernetes workload identity
- IRSA (AWS) — pod SA → IAM role
- Workload Identity (GCP) — K8s SA → GCP SA
For calling cloud APIs, not service-to-service HTTP (mesh handles latter).
Policy-as-code (OPA)
Central policy: "payments can call ledger; marketing cannot."
Enforce at sidecar (Istio AuthorizationPolicy) or admission controller.
Gateway vs mesh auth
| Layer | Auth |
|---|---|
| Gateway | User JWT, API keys |
| Mesh | Service identity mTLS |
| Service | Resource-level RBAC |
Interview gap to flag honestly
Full AppSec depth for OAuth edge cases and browser security lives in Security for Engineers track — this subtopic covers service-to-service mTLS and workload identity only.
Cross-reference: Security → Distributed Platform Security; API Gateway for user AuthN.