Zero Trust Kubernetes Security: mTLS, OIDC, SPIFFE/SPIRE & NetworkPolicies

In modern cloud-native infrastructures, relying solely on perimeter security (firewalls and VPNs) is insufficient. Inside a Kubernetes cluster, once an attacker compromises a single pod, flat network architectures allow uninhibited lateral movement across namespaces.

Zero Trust in Kubernetes follows a simple principle: Never trust, always verify every request, regardless of whether it originates inside or outside the cluster boundary.

1. The 4 Pillars of Kubernetes Zero Trust

1. Cryptographic Workload Identity (SPIFFE/SPIRE): Every running pod gets a short-lived SVID (SPIFFE Verifiable Identity Document) X.509 certificate.
2. Mutual TLS (mTLS): All pod-to-pod network traffic is encrypted and authenticated at both ends.
3. Strict Network microsegmentation (Cilium / Calico): Default-deny network policies at Layer 4 and Layer 7.
4. OIDC Authentication for API Server: Identity provider integration for kubectl admin access.

2. Implementing Workload Identity with SPIFFE/SPIRE

Instead of embedding long-lived AWS IAM keys or API tokens into pod secrets, SPIRE attests pod identities dynamically via the Kubernetes API.

# SPIRE Agent WorkloadAttestor Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: spire-agent
  namespace: spire
data:
  agent.conf: |
    agent {
      data_dir = "/run/spire"
      log_level = "DEBUG"
      server_address = "spire-server"
      server_port = "8081"
      trust_domain = "prod.vyuhantrix.internal"
    }
    plugins {
      WorkloadAttestor "k8s" {
        plugin_data {
          skip_kubelet_verification = false
        }
      }
      KeyManager "memory" {}
    }

3. Microsegmentation with Cilium L7 NetworkPolicies

Traditional NetworkPolicy objects only filter by IP and Port (Layer 4). Cilium uses eBPF to enforce granular HTTP path and REST method filtering (Layer 7) without sidecar overhead.

apiVersion: "cilium.io/2v2"
kind: CiliumNetworkPolicy
metadata:
  name: restrict-payment-service-access
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: payment-service
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: checkout-api
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: "POST"
          path: "/api/v1/charge"

Why eBPF Beats Traditional Sidecar Proxies:

• Zero Proxy Latency: Bypasses TCP stack traversal in Linux kernel space.
• Lower Memory Footprint: Eliminates 50MB+ Envoy sidecar memory overhead per pod.

4. Strict mTLS Enforcement via Istio Service Mesh

To mandate 100% encrypted mTLS between services and reject unencrypted fallback connections, apply a cluster-wide PeerAuthentication policy:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default-strict-mtls
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

5. Security Checklist & Production Audit Matrix