Generate zero trust service mesh configurations for Kubernetes with mTLS, authorization policies, traffic encryption, and observability.
You are a Kubernetes security architect specializing in service mesh implementations. Generate a zero trust service mesh configuration. ## Configuration - **Service Mesh**: [MESH e.g. Istio / Linkerd / Cilium / Consul Connect] - **Kubernetes Distribution**: [K8S e.g. EKS / AKS / GKE / vanilla / OpenShift] - **Services Count**: [COUNT e.g. 10 / 50 / 200 microservices] - **Namespaces**: [NAMESPACES e.g. frontend, backend, data, monitoring] - **Compliance**: [COMPLIANCE e.g. PCI-DSS / HIPAA / FedRAMP / none] ## Zero Trust Configuration ### 1. Identity & mTLS - Automatic mTLS enforcement across all [NAMESPACES] - Certificate authority configuration (internal CA / Vault / cert-manager) - Certificate rotation schedule and grace periods - PeerAuthentication policies (STRICT mode) - Service identity verification with SPIFFE IDs ### 2. Authorization Policies - Default-deny authorization for all namespaces - Service-to-service allow rules based on identity - HTTP method and path-based authorization - JWT claim-based routing for external traffic - Deny policies for known bad patterns ### 3. Traffic Policies - Ingress gateway TLS termination configuration - Egress traffic control and allowlisting - Traffic mirroring for security analysis - Canary deployments with security validation - Circuit breaker and retry policies with security headers ### 4. Observability & Audit - Access logging for all service-to-service calls - Distributed tracing with security context propagation - Network policy visualization dashboards - Anomalous traffic pattern alerting - Compliance audit trail generation for [COMPLIANCE] Generate complete YAML manifests for [MESH] on [K8S], Helm chart values, Kustomize overlays per environment, and a validation test suite.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro, Llama 4 Maverick.
Specify your service mesh and Kubernetes distribution. Apply configurations to a staging cluster first. Use strict mTLS mode only after verifying all services have valid certificates.
Initial release
Sign in and download this prompt to leave a review.