Service Mesh Platform  ·  View 06 of 31  ·  2 · People and journeys

Journey — Contain a Compromised Workload

A report-generation pod starts calling the payments service. The engineer has to make a stolen identity useless while the certificate is still valid.

Editable source SVG draw.io All views
Security engineer on call Goal — Make a stolen workload identity useless Trigger — report-gen calling payments, never seen before Done when — Cut off in minutes, dead in 24 h, audit complete 1 · Detect 2 · Attribute 3 · Cut off ◆ moment of truth 4 · Evict 5 · Expire 6 · Report What they do Gets undeclared-call alert Queries access logs Merges emergency deny Bans node · kills pod Waits out the SVID Pulls issuance record System behind it Alertmanager Access logs Deny policy · Cilium SPIRE agent ban 24 h lifetime Issuance records How it feels Calm Tense Alarmed Where it hurts Pod IP already reused Deny rides a config push Stolen cert still valid What the platform gives Caller named by identity Peer identity per hop L3 block, second plane Key proves one identity Useless after ≤ 24 h Attestation per cert Journey — A Security Engineer Makes a Stolen Identity Useless v 1.0 · owner Platform Networking Architecture · date 2026-09

The trough, and what answers it

  • A mesh deny propagates as configuration, typically within 15 s but not at all if istiod is down. The engineer therefore applies a second, independent block: a Cilium network policy isolating the pod, enforced by node agents that do not depend on istiod.
  • The stolen certificate stays valid for up to 24 hours. That window is accepted by design; containment comes from the deny, the ban and the fact that the key proves only one identity.

Decisions behind it

  • Short lifetimes, not revocation lists, are the containment mechanism (ADR-08). Banning the SPIRE agent stops renewal; deleting the pod removes the key.
  • Every access log line carries the authenticated peer identity. Pod IPs are recycled within minutes, so an IP-keyed investigation ends in the wrong place.

Targets

  • Emergency deny effective on 95% of proxies ≤ 15 s p99 with the control plane up. Stolen identity useless ≤ 24 h in every case.
◀  Journey — Canary a Release at 1% All views Layered Architecture  ▶
Solution Architecture v1.0 · Platform Networking Architecture · 2026-09 · 31 views · open source, fully on-premises06-journey-contain-a-compromised-workload