Zero-trust networking replaces implicit trust in network location with explicit identity-based authentication and authorization for each access path. In Anthos environments, this posture is implemented declaratively through Anthos Service Mesh, VPC Service Controls, and policy-management capabilities without changing application code. section 4.5.4 section 7.4.1
A practical implementation decomposes the policy into several controls:
- Issue workload identities and mTLS certificates through Mesh CA or an Istio certificate authority, using a shared root of trust where appropriate. section 4.5.4 section 4.3.3
- Authenticate peers and authorize communication by mTLS identity rather than IP address, restricting which workloads may communicate. section 4.5.4 section 7.4.1
- Apply request claims-aware policies to HTTP or gRPC traffic and use Identity-Aware Proxy when user authentication is required. section 4.5.4
- Constrain access to Google Cloud APIs with VPC Service Controls based on allowed IP addresses, identities, and client devices. section 7.4.1
- Centralize additional guardrails through role-based access control, Policy Controller, and continuously synchronized configuration. section 7.4.1
Regulated hybrid application
A regulated deployment can combine VPC Service Controls for Google Cloud API boundaries, Anthos Config Management for synchronized policy, and Anthos Service Mesh for mTLS and narrowly defined pod communication. This limits unauthorized access and reduces data-exfiltration risk if a rogue pod is deployed. section 7.4.1
Use the architecture figure to inspect how VPC Service Controls, Anthos Config Management, and Anthos Service Mesh combine in a regulated application. section 7.4.1
