Service mesh integration with mutual#113
Open
gloskull wants to merge 2 commits into
Open
Conversation
…al-tls Add Istio service-mesh mTLS, blue-green routing, monitoring and validation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Enforce cluster-wide mutual TLS and explicit allowlists for the utility-contracts namespace to meet security requirements.
Preserve critical-path P99 latency (<100ms) and 99.99% availability via connection pooling, retries, timeouts, and outlier detection.
Provide a blue-green/canary deployment pattern and runbook to enable safe rollouts and fast rollback.
Add offline validation and automated tests so manifests can be verified in CI before cluster application.
Description
Add Istio security manifests: PeerAuthentication/utility-contracts-strict-mtls and AuthorizationPolicy/utility-contracts-service-allowlist in deploy/service-mesh/mtls-policy.yaml to enforce STRICT mTLS and an explicit allowlist.
Add DestinationRule with ISTIO_MUTUAL TLS, connection pool sizing, connect timeout (100ms) and outlier detection in deploy/service-mesh/destination-rules.yaml to bound tail latency and improve resilience.
Add blue-green VirtualService and subset DestinationRule in deploy/service-mesh/traffic-policy.yaml to support blue/green deployments, x-canary header matches, 100ms timeouts, and bounded retries.
Add Prometheus SLO alerts in deploy/service-mesh/monitoring.yaml to detect P99 latency regressions, availability below 99.99%, and mTLS policy drift.
Add a runbook docs/SERVICE_MESH_MTLS.md documenting architecture, deployment steps, canary gates, rollback, and validation commands.
Add an offline manifest validator scripts/validate_service_mesh.py and pytest coverage tests/test_service_mesh_manifests.py to validate the security/SLO invariants without cluster access.
Testing
Ran the offline validator: python3 scripts/validate_service_mesh.py which printed success and exited 0.
Ran the pytest suite: python3 -m pytest tests/test_service_mesh_manifests.py with all tests passing (4 passed).
Both validation script and pytest were executed locally and succeeded.
Closes #71