poc-mesh

This directory contains a namespace-scoped Istio service-to-service policy POC for poc-mesh. It demonstrates STRICT mTLS, deny-by-default authorization, explicit allow rules based on Kubernetes service account identity, and traffic patterns that are easy to inspect in Kiali.

Directory layout

poc-mesh/
  manifests/
    00-namespace.yaml
    10-apps.yaml
    20-mtls.yaml
    30-authz.yaml
  scripts/
    apply.sh
    test.sh
  README.md

Architecture

The POC creates a dedicated namespace named poc-mesh with Istio sidecar injection enabled and deploys three internal services:

• frontend: developer-friendly caller workload using frontend-sa
• backend: echo-style HTTP API using backend-sa
• payments: second caller workload using payments-sa

All workloads are internal-only ClusterIP Services. The backend uses mendhak/http-https-echo:34, a common public demo image that replies on arbitrary paths and methods without requiring a custom image build. That makes it a good fit for testing:

• GET /api/orders
• POST /api/orders
• GET /health

frontend and payments use wbitt/network-multitool:extra, which keeps the Pods easy to inspect and includes curl for in-cluster tests.

Why deny-all plus allow-list

The namespace uses a default-closed authorization posture:

1. namespace-deny-all blocks traffic unless a later ALLOW policy matches.
2. backend-allow-frontend-read grants only the exact traffic the POC wants to demonstrate.
3. backend-deny-payments-example is an explicit readability example showing that payments is not supposed to call backend.

This pattern is easier to reason about than permissive defaults because any new workload or path starts denied until it is deliberately opened.

How AuthorizationPolicy uses service accounts

Istio converts the source workload identity into a SPIFFE-like principal. In this POC the principals are:

• cluster.local/ns/poc-mesh/sa/frontend-sa
• cluster.local/ns/poc-mesh/sa/backend-sa
• cluster.local/ns/poc-mesh/sa/payments-sa

The backend ALLOW policy matches only frontend-sa and only for:

• GET /api/orders
• GET /health

Because POST /api/orders is not listed, it is denied even from frontend. Because payments-sa is not allowed, payments is denied even when it uses the same path.

Apply the POC

cd examples/eks-with-istio-gateway-api/poc-mesh
chmod +x scripts/apply.sh scripts/test.sh
./scripts/apply.sh

Run the tests

cd examples/eks-with-istio-gateway-api/poc-mesh
./scripts/test.sh

Expected results:

• frontend -> backend GET /api/orders: PASS
• frontend -> backend GET /health: PASS
• frontend -> backend POST /api/orders: PASS because the request is correctly denied with HTTP 403
• payments -> backend GET /api/orders: PASS because the request is correctly denied with HTTP 403

What to look at in Kiali

After running the tests, Kiali should make the policy behavior easy to understand:

• Graph view for namespace poc-mesh
• Successful traffic edge from frontend to backend
• No permitted payments -> backend access pattern
• mTLS indicators on workloads and edges
• Workload details on backend showing inbound traffic and security context

The denied requests may not appear as a normal successful edge in every graph mode, but the backend and source workload metrics should still help explain what happened.

Verify Kiali and Prometheus are installed

kubectl get pods -A | grep -E 'kiali|prometheus'
kubectl get svc -A | grep -E 'kiali|prometheus'

Port-forward Kiali

Common install location:

kubectl -n istio-system port-forward svc/kiali 20001:20001

If the service is installed elsewhere:

kubectl get svc -A | grep kiali
kubectl -n <kiali-namespace> port-forward svc/<kiali-service-name> 20001:20001

Port-forward Prometheus

First find the service:

kubectl get svc -A | grep prometheus

Common examples:

kubectl -n monitoring port-forward svc/prometheus-server 9090:80
kubectl -n istio-system port-forward svc/prometheus 9090:9090

Notes

• No Gateway API or ingress is used here.
• All traffic stays inside the cluster.
• The POC is intentionally small so developers can correlate policy YAML, test output, and Kiali visuals quickly.