Istio Security Architecture Layers

Istio Security Architecture Layers An architecture diagram generated by Archify. Certificate Authority · X.509 cert issuance · Control Plane (istiod) Certificate Authority X.509 cert issuance Configuration API · Security policy push · Control Plane (istiod) Configuration API Security policy push Application · Plaintext traffic · Data Plane (Envoy Proxy) › Pod A Application Plaintext traffic Envoy Sidecar · mTLS termination · policy · Data Plane (Envoy Proxy) › Pod A Envoy Sidecar mTLS termination · policy Envoy Sidecar · mTLS termination · policy · Data Plane (Envoy Proxy) › Pod B Envoy Sidecar mTLS termination · policy Application · Plaintext traffic · Data Plane (Envoy Proxy) › Pod B Application Plaintext traffic 1. Identity · SPIFFE ID based · Security layer order (5 steps) 1. Identity SPIFFE ID based 2. Cert Mgmt · Auto issue / renew · Security layer order (5 steps) 2. Cert Mgmt Auto issue / renew 3. Peer Auth · Service-to-service mTLS · Security layer order (5 steps) 3. Peer Auth Service-to-service mTLS 4. Req Auth · End-user JWT · Security layer order (5 steps) 4. Req Auth End-user JWT 5. Authorization · Access control · Security layer order (5 steps) 5. Authorization Access control Issue certificates Push policy mTLS Control Plane (istiod) Data Plane (Envoy Proxy) Pod A Pod B Security layer order (5 steps) Legend Backend Security

Identity Management

  • • Workload identity based on the SPIFFE standard
  • • Integrated with Kubernetes ServiceAccount
  • • Automatic certificate renewal (default 24 hours)

Policy Engine

  • • Declarative security policies (CRD-based)
  • • Fine-grained access control (RBAC)
  • • Audit logging support