Zero Trust Security Architecture: Never Trust, Always Verify

Traditional perimeter security assumed "internal network = safe, VPN = trusted". Cloud-native work, remote teams, and SolarWinds-class supply chain attacks killed that boundary. NIST SP 800-207 defines Zero Trust: every access gets explicit authentication, least-privilege authorization, encryption of all traffic, and end-to-end auditability.

Six Core Pillars Implementation

Identity is the new perimeter: OIDC/SAML SSO with mandatory MFA (TOTP + Passkey minimum), step-up challenges by risk score. Device health: MDM verifies OS patches, EDR, full-disk-encryption; unmanaged devices get only sandboxed access. Microsegmentation: strict service-to-service mTLS, authorization by identity+method+path triples, never by CIDR block.

# ====== 1. SPIFFE SPIRE 颁发服务身份（Workload Identity）======
# 注册 workload registration entry
spire-server entry create   -parentID "spiffe://example.com/k8s-ns/production"   -spiffeID "spiffe://example.com/svc/payment-gateway"   -selector "k8s:ns"   -selector "k8s:sa"   -value "payment-sa"   -dns "payment.internal.example.com"   -ttl 3600

# ====== 2. Istio 授权策略（服务粒度 mTLS + RBAC）======
cat <<'EOF' | kubectl apply -f -
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: payment-rbac
  namespace: production
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: payment-gateway
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/production/sa/order-service"
              - "cluster.local/ns/production/sa/checkout-worker"
      to:
        - operation:
            methods: ["POST"]
            paths: ["/v1/charges", "/v1/refunds"]
      when:
        - key: request.auth.claims[roles]
          values: ["payments:write"]
EOF

# ====== 3. OPA Gatekeeper 命名空间隔离 ======
cat <<'EOF' | kubectl apply -f -
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: namespace-must-have-owner-and-tier
spec:
  match:
    kinds: [{ apiGroups: [""], kinds: ["Namespace"] }]
  parameters:
    labels:
      - key: "security.example.com/owner"
      - key: "security.example.com/data-tier"
        allowedRegex: "^(public|internal|restricted)$"
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedPrivileged
metadata:
  name: block-privileged-containers-in-restricted
spec:
  match:
    scope: Namespaced
    kinds: [{ apiGroups: [""], kinds: ["Pod"] }]
    labelSelector:
      matchExpressions:
        - key: security.example.com/data-tier
          operator: In
          values: ["restricted"]
EOF

# ====== 4. 身份层：Keycloak MFA + 条件访问策略 ======
# 启用 TOTP OTP + WebAuthn (Passkey) 双重挑战
kcadm.sh update authentication/flows -r master   --alias "browser" -b '{
  "authenticationExecutions": [
    {"authenticator":"auth-cookie","requirement":"ALTERNATIVE"},
    {"authenticator":"identity-provider-redirector","requirement":"ALTERNATIVE"},
    {"level":"1","required":"true","requirement":"CONDITIONAL"},
    {"authenticator":"basic-auth","requirement":"REQUIRED"},
    {"authenticator":"conditional-user-configured","requirement":"REQUIRED"},
    {"authenticator":"otp-form","requirement":"REQUIRED"},
    {"authenticator":"webauthn-authenticator","requirement":"ALTERNATIVE"}
  ]}'

# 按风险评分拒访：异常IP + 非受管设备
kcadm.sh create clients -r master -s clientId=risk-engine   -s 'attributes."risk.score.threshold"=70'   -s 'attributes."risk.check.geo_anomaly"=true'   -s 'attributes."risk.check.managed_device"=true'

# ====== 5. 审计事件转发 SIEM ======
# Falco 运行时异常规则
cat <<'EOF' > /etc/falco/rules.d/zero-trust-rules.yaml
- rule: DB 服务向外建立可疑连接
  desc: MySQL/PG 不应主动发起外连，可能发生数据外泄
  condition: >
    spawned_process and proc.name in (mysql, postgres) and
    outbound and not fd.sip in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  output: >
    DB 服务疑似数据外泄 user=%user.name proc=%proc.name
    dst_ip=%fd.sip dst_port=%fd.sport cmd=%proc.cmdline
  priority: CRITICAL
  tags: [zero-trust, data-exfiltration, mitre:T1041]
EOF
systemctl restart falco
falco -r /etc/falco/falco_rules.yaml -r /etc/falco/rules.d/zero-trust-rules.yaml

# ====== 6. Tailscale + OIDC 取代 VPN：每用户按设备入网 ======
tailscale up   --ssh   --accept-dns   --accept-routes   --exit-node=""   --auth-key="tskey-client-XXX"   --advertise-tags=tag:backend,tag:production

# 在 Tailscale ACL 控制台写入最小权限
# "acls": [ { "action": "accept", "src": ["group:sre"],
#             "dst": ["tag:production:*", "tag:backend:22"] } ]

Control Plane + Data Plane + Audit Plane Layers

Control plane (SPIRE/Istio) issues short-lived X.509/SVID (1h TTL so leaks revoke fast); OPA/Gatekeeper does static constraint policy. Data plane per-service Sidecar or kernel eBPF (Cilium) packet-level enforces authorization. Audit plane: Falco runtime rules, K8s audit logs, Keycloak events all streamed to SIEM (Splunk/Elastic) — correlated by user ID + device fingerprint + service request ID for forensic timelines and compliance.

Best Practices

Three-phase roadmap: P1 (1-3mo) unify identity + mandate MFA + replace VPN with ZTNA; P2 (3-6mo) K8s mTLS STRICT + authz policies; P3 (6-12mo) runtime eBPF detection + end-to-end audit + ABAC dynamic trust. Zero Trust is not a product — it's architectural evolution requiring sustained investment.