POWERING THE WORLD’S APPLICATION NETWORKS

Adam Zwickey

Solutions Engineering

Jan 2020
Cloud Native Shift

Service Mesh Architecture

Key Ingredients to Enabling ZTA

Operationalizing

Ingredients

2
Cloud Native Shift

Attack Surface Area

All Resources Networked Attached

New Paradigm For Identity, Trust, and Verification

All Shifted to App Teams
Mesh Architecture Protects You

The Unwanted Ingredients

[Weak] Leaked Credentials Unpatched or Misconfigured Software Time Implicit Trust

4

<image from marketing>
What is a 

Service 

Mesh?

Service Service

Proxy Proxy

Configuration Security Discovery

Ingress traffic Mesh traffic Egress traffic

Data plane Control Plane 

Certificates

Metrics Metrics

A Service Mesh is a dedicated & transparent 

infrastructure layer placed between the 

application and the network that enables 

Reliable, Fast, and Secure service 

communication
Service Identity

A service mesh will issue cryptographically-verifiable 

workload identity for all services this is not tied to 

infrastructure 

SPIFFE is widely adopted identity framework most 

commonly utilizing short very lived X.509 certificates 

Cluster 1 

App 1

POD

App 1

POD

Workload

POD

(Service)

Workload

POD

(Service)

Workload

POD

(Service)

Workload

POD

(Service)

Frontend 1 Frontend 1

App 1

App 2

Identity

Cluster 2 

App 1

POD

backend

App 3

spiffe://trust-domain-name/path

SM 

Control 

Plane

SM 

Control 

Plane
mTLS

X.509-based identities are utilized in a full stack solution for 

transport authentication and encryption of data in transit

Mesh sidecars serve as Policy Enforcement Points (PEPs) 

guarantee policy conformance with zero application changes

Cluster 1 

App 1

POD

Workload

POD

(Service)

Workload

POD

(Service)

Frontend 1

App 1

App 2

Identity

Cluster 2 

App 3

SM 

Control 

Plane

SM 

Control 

Plane

proxy

Workload

POD

(Service)

proxy

Workload

proxy

(Service)

POD
Fine-grained control over end user and/or external upstream 

service requests

Control end user AuthN/Z based on identity expressed in 

JWT credential or layer 7 request attributes

End User Credential & 

Identity Cluster 1 

App 1

POD

Frontend 1

App 1

Cluster 2 

App 3

Workload

POD

(Service)

proxy

Workload

proxy

(Service)

POD

User Identity Provider
A Service Mesh provides centralized policy management 

with distributed runtime enforcement

Whitelisting/Blacklisting or shape traffic based on service, IP, 

layer 4/7 request attributes, or logical environment

Usually a combination of many 

Network Policy

9

Cluster 1 

App 1

POD

Workload

POD

(Service)

Workload

POD

(Service)

Frontend 1

App 1

App 2

Cluster 2 

SM App 3

Control 

Plane

SM 

Control 

Plane

proxy

Workload

POD

(Service)

proxy

Workload

proxy

(Service)

POD
Operationalize

Mesh With 

DevSecOps

10

As complexity increases:

- Multi-Cluster

- Multi-Cloud

- Hybrid Cloud

- Integration with Legacy

ZTA must be built into automation toolchains

Cloud 2 Clusters 

App 1

POD

App 1

POD

Workload

POD(Service)

Workload

POD

(Service)

Workload

POD

(Service)

Workload

POD

(Service)

App 1

VMVM

App 1 Workload VM

(Service)

Workload

VM

(Service)

Workload

VM

(Service)

Workload

VM

(Service)

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

Frontend 1 Frontend 1 Backend 1 Backend 1

On Prem Cloud and VM Pool

DMZ Cloud Cluster 1 

App 1

POD

App 1

POD

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

Frontend 1 Frontend 1

Workload

POD

(Service)

Workload

POD

(Service)

Workload

POD

(Service)

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

Workload

POD(Service)

App 1

App 2

App 3
For any further queries, feel free to contact us at info@tetrate.io

Contact

Thank You

@tetrateio Tetrate www.tetrate.io