mTLS

With mutual TLS (mTLS) both sides present their certificates: the traffic is encrypted and each service's identity (a SPIFFE identity derived from the ServiceAccount) is verified. Istio issues and rotates the certificates automatically. A PeerAuthentication determines whether mTLS is required:

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: varsayilan
  namespace: magaza
spec:
  mtls:
    mode: STRICT        # PERMISSIVE: accepts both plain and mTLS

During migration you start with PERMISSIVE; once all clients have joined the mesh, you switch to STRICT.

Thanks to mTLS identities, an AuthorizationPolicy writes rules like "only the web service may GET api's /urunler path":

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: api-erisim
  namespace: magaza
spec:
  selector:
    matchLabels: {app: api}
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/magaza/sa/web"]
      to:
        - operation:
            methods: ["GET"]
            paths: ["/urunler*"]