Security

Secure workloads in ambient mesh using Istio’s built-in authorization and authentication functionality.

Ambient mesh transparently adds mutual TLS (mTLS) encryption between all enrolled workloads. You can also configure policies for authentication and authorization to mitigate both internal and external threats against your data, endpoints, communication, and platform.

Istio’s security architecture

Each workload in a mesh has an identity based on its namespace and service account. The Istio control plane provides a Certificate Authority (CA) for key and certificate management. Each proxy requests certificates as needed, which are used to mutually verify connections.

ztunnel proxies operate on behalf of all workloads on a given node and request certificates for each workload. Gateways and waypoints each have their own identities.

Authentication

Ambient mesh offers two kinds of authentication:

• Peer authentication validates the identity of a connection source using mTLS. By default, services in the mesh accept non-mTLS connections, but this can be overridden.
• Request authentication validates a JSON Web Token (JWT) on an L7 request. This requires a waypoint.

Authorization

Authorization policy controls access to traffic in an ambient mesh. Because all connections are authenticated, policies can reference the caller’s identity.

Policies enforced by ztunnel support L4 attributes only. To enforce L7 attributes — such as HTTP methods, headers, or request paths — a waypoint must be deployed for the target workload.

• To apply L4 authorization policies with ztunnel, see Authorization policies with ztunnel.
• To apply L7 authorization policies with a waypoint, see Authorization policy with waypoint proxies.

How certificates are issued

In ambient mesh, the secure overlay layer handles mTLS encryption. ztunnel must request and be issued certificates for every workload running on its host.

1. Ztunnel creates a key and requests a certificate. When a workload starts on a node, the CNI agent notifies the ztunnel. The ztunnel connects to the Istio control plane, stating that it represents that workload, and requests attestation and signing of a certificate.

2. Istiod verifies the request. Istiod checks that the workload is running on the node in question. ztunnel is authorized to request certificates for any service accounts of pods running on the same node. Similar to kubelet node authorization, this explicitly does not allow requesting arbitrary certificates, ensuring these privileges are node-local only. For more information, see the Istio security model documentation.

3. A certificate is issued. The control plane signs the request and returns the certificate to ztunnel.