Service Mesh Platform  ·  View 04 of 31  ·  2 · People and journeys

Journey — Move a Service to Strict mTLS

The payments-ledger team closes an audit finding. The low points are finding the callers they did not know about, and the moment plaintext is refused.

Editable source SVG draw.io All views
Service team payments-ledger Goal — Refuse plaintext without breaking a caller Trigger — Audit finding: 3% of calls still plaintext Done when — Strict mode, no legitimate call denied 1 · Find callers 2 · Mesh them 3 · Write allow 4 · Dry run 5 · Go strict ◆ moment of truth 6 · Hold What they do Opens plaintext report Meshes two batch jobs Writes allow by identity Runs policy in dry-run Merges the strict flip Watches denials 7 days System behind it Plaintext report Injection policy Security intent repo Shadow rules Config waves Denial dashboard How it feels Confident Unsure Anxious Where it hurts Who are the 3%? Legacy job resists Which principals? Feels one-way What the platform gives Callers named Opt-out per workload Survives rescheduling Would-deny list, live Impact gate at 0.5% Revert in one step Journey — A Service Team Refuses Plaintext Without Breaking a Caller v 1.0 · owner Platform Networking Architecture · date 2026-09

The trough, and what answers it

  • Going strict feels like a one-way door, because the first sign of a missed caller is an outage. Three things make it reversible: the dry-run report shows who would be denied, the impact gate refuses a change that would deny more than 0.5% of current traffic, and reverting the change is a single operation.
  • "Who are the 3%?" is answered by identity, not IP. The plaintext report lists sources as workload identities where they have one and as 'no identity, pod in namespace X' where they do not.

Decisions behind it

  • Strict mode is set per service by a reviewed change in the security repository, never by a fleet-wide flag (ADR-10).
  • A workload that cannot take a sidecar is opted out explicitly and appears on the report by name. It can still call a strict service only through a declared exception, which is also visible.

Targets

  • Plaintext share per service reported daily; strict flip converges on 95% of proxies within 5 s p95.
  • No legitimate call denied during the seven-day hold, measured from access logs rather than from the absence of complaints.
◀  Actors and Their Core Journeys All views Journey — Canary a Release at 1%  ▶
Solution Architecture v1.0 · Platform Networking Architecture · 2026-09 · 31 views · open source, fully on-premises04-journey-move-a-service-to-strict-mtls