Initial commit

infrastructure/istio/manifests/mesh/peer-authentication.yaml

@@ -0,0 +1,12 @@
+# Mesh-wide STRICT mTLS - Zero Trust
+# All service-to-service communication must present valid SPIFFE SVID
+# In ambient mode, ztunnel enforces mTLS for all enrolled namespaces
+# Services outside the ambient mesh will be rejected
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  mtls:
+    mode: STRICT