Istio config with strict mTLS, a 90/10 canary split and an authz policy locking payments to checkout only

Istio service mesh config for three services (`web`, `checkout`, `payments`) on EKS. STRICT mTLS everywhere, a canary split on `checkout`, and an authz policy that locks `payments` down to `checkout` only. ```yaml # strict mTLS for the whole namespace — no plaintext between pods apiVersion: security.istio.io/v1 kind: PeerAuthentication metadata: { name: default, namespace: payments } spec: mtls: { mode: STRICT } --- # canary: 90% to stable, 10% to the new checkout build apiVersion: networking.istio.io/v1 kind: VirtualService metadata: { name: checkout, namespace: payments } spec: hosts: [checkout] http: - route: - destination: { host: checkout, subset: stable } weight: 90 - destination: { host: checkout, subset: canary } weight: 10 retries: { attempts: 3, perTryTimeout: 2s, retryOn: "5xx,reset" } timeout: 5s --- apiVersion: networking.istio.io/v1 kind: DestinationRule metadata: { name: checkout, namespace: payments } spec: host: checkout trafficPolicy: connectionPool: { tcp: { maxConnections: 100 } } outlierDetection: { consecutive5xxErrors: 5, interval: 30s, baseEjectionTime: 60s } subsets: - { name: stable, labels: { version: v1 } } - { name: canary, labels: { version: v2 } } --- # only checkout may call payments — zero-trust east-west apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata: { name: payments-allow-checkout, namespace: payments } spec: selector: { matchLabels: { app: payments } } action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/payments/sa/checkout"] ``` **What each piece buys you:** `PeerAuthentication STRICT` enforces mutual TLS so a compromised pod can't sniff traffic; `outlierDetection` is the circuit breaker — it ejects an instance after 5 consecutive 5xx; the `AuthorizationPolicy` is identity-based (SPIFFE principal), not IP-based, so it survives pod rescheduling. **Observability:** enable Kiali + a 1% access-log sample to keep sidecar overhead low. Roll the canary forward by shifting the `VirtualService` weights.