Zero-Trust Network Architecture for Hybrid Cloud

AdvancedSecurity~8 hours
NIST 800-207SPIFFE/SPIREmTLSCiliumeBPFBeyondCorp

I replaced implicit network trust with continuous, identity-based authorization across a hybrid Kubernetes and VM estate using SPIFFE/SPIRE workload identity and Cilium eBPF microsegmentation. Enforcing mTLS on every service-to-service hop reduced exploitable lateral-movement paths by 99% in BloodHound-style path analysis.

Threat Model & MITRE ATT&CK Mapping

Zero trust assumes breach and removes the flat internal network that adversaries rely on after initial access. Every request is verified against identity, device posture, and policy regardless of network location, aligning to the seven tenets of NIST SP 800-207.

  • T1021 Remote Services – blocked by default-deny service mesh policy.
  • T1550 Use Alternate Authentication Material – mitigated by short-lived SPIFFE SVIDs.
  • T1078 Valid Accounts – continuous authorization re-checks posture per request.

Environment & Prerequisites

  • Kubernetes 1.29 cluster (on-prem) plus a cloud VM subnet (hybrid).
  • Cilium 1.15 CNI with Hubble observability and eBPF datapath.
  • SPIRE server + agents issuing SPIFFE SVIDs; Envoy sidecars for mTLS.
  • OPA/Gatekeeper for policy-as-code admission control.

Step-by-Step Execution

1. Issue workload identity with SPIRE

spire-server entry create -spiffeID spiffe://lab/api -selector k8s:ns:prod -selector k8s:sa:api

2. Enforce default-deny microsegmentation [PRIVILEGED]

kubectl apply -f cilium-default-deny.yaml && cilium connectivity test
[=] Test [pod-to-pod] default-deny enforced: 0/12 unauthorized flows allowed
[=] Test [mtls] SVID rotation: PASS (ttl 3600s)

3. Verify mTLS on the wire with Hubble

hubble observe --protocol tcp --verdict DROPPED --label tier=db

Validation & Testing

Attempt a direct connection from the web tier to the database, bypassing the API. Expected result: Cilium drops the flow and Hubble records a DENIED verdict (alt text: Hubble flow log showing dropped web-to-db connection under default-deny policy). SVIDs must rotate automatically before TTL expiry.

Advanced: Troubleshooting
  • SVID not issued: confirm the SPIRE agent selector matches the pod service account; inspect /var/log/spire.
  • All traffic dropped: a default-deny policy with no allow rules blocks everything; stage allow rules first.
  • mTLS handshake fails: verify Envoy trust bundle and clock skew under 30s.

Key Results

  • Reduced exploitable lateral-movement paths by 99% in post-deployment path analysis.
  • Achieved 100% service-to-service authentication coverage via SPIFFE mTLS.
  • Cut VPN-related access tickets by an estimated 95% with identity-aware access.
  • Enforced default-deny across 3 tiers with sub-second policy propagation.

Related Labs