# Enforcing mTLS Between Spatial Domains

Turning on STRICT mutual TLS between the workloads that make up a federated geospatial estate, so a cross-domain tile or vector call can only succeed when the caller presents a valid, verifiable workload identity — and is refused at transport otherwise. This is the concrete operational procedure behind the Zero-Trust Security for Spatial Endpoints model within the broader Federated Ownership & Routing Architecture: you flip Istio’s peer authentication to STRICT for each domain namespace, verify with istioctl that no plaintext path remains, and require the mTLS-derived principal in the AuthorizationPolicy so an unauthenticated caller can never reach a cadastral feature store. It assumes the domain boundaries you are locking down were already drawn per Spatial Domain Boundary Design.

# Prerequisites

# Step-by-Step Implementation

Migrate one domain at a time. Enabling STRICT globally before every workload has a sidecar and a valid SVID will hard-fail plaintext callers, so the sequence below tightens transport first, verifies, then requires identity in authorization. Each step ends with a verification command.

# 1. Confirm sidecar injection and current mTLS posture

Before changing anything, confirm every workload in the domain namespace carries an Istio proxy and see whether traffic is already mutually authenticated. A pod without a sidecar cannot present an SVID and will be locked out the moment STRICT is applied.

kubectl get pods -n cadastral \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].name}{"\n"}{end}'
# every pod must list an "istio-proxy" container

Verify: inspect the effective TLS settings the mesh reports for the workload.

istioctl x describe pod -n cadastral $(kubectl get pod -n cadastral \
  -l app=wfs-feature-engine -o jsonpath='{.items[0].metadata.name}')
# look for "mTLS: PERMISSIVE" in the current state before you tighten it

# 2. Apply STRICT PeerAuthentication to the domain namespace

Scope STRICT mutual TLS to the single domain namespace so the blast radius is one domain, not the mesh. STRICT rejects any plaintext peer at transport — the connection is reset before HTTP is parsed.

# strict-cadastral.yaml — require verified mTLS on every inbound edge of the
# cadastral domain. Namespaced, so other domains stay PERMISSIVE until migrated.
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: cadastral-mtls-strict
  namespace: cadastral
spec:
  mtls:
    mode: STRICT

kubectl apply -f strict-cadastral.yaml

Verify: confirm the policy is active and scoped to the intended namespace.

kubectl get peerauthentication -n cadastral
istioctl authn tls-check \
  $(kubectl get pod -n geocode -l app=resolver -o jsonpath='{.items[0].metadata.name}').geocode \
  wfs-feature-engine.cadastral.svc.cluster.local
# STATUS must read OK and SERVER must read STRICT for the cadastral destination

# 3. Require the mTLS identity in the AuthorizationPolicy

STRICT transport proves the channel is encrypted and the peer is verified; it does not by itself restrict which verified identity may call. Add an allow-list AuthorizationPolicy keyed on the SPIFFE principal so only the gateway and named sibling domains reach the endpoint. Unmatched requests fall through to an implicit 403 DENY.

# authz-cadastral.yaml — only these workload identities, over verified mTLS,
# may GET the OGC API endpoints. Default action for a non-match is DENY.
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: cadastral-endpoint-authz
  namespace: cadastral
spec:
  selector:
    matchLabels:
      app: wfs-feature-engine
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/gateway/sa/geospatial-gateway"
              - "cluster.local/ns/routing/sa/cross-domain-router"
      to:
        - operation:
            methods: ["GET"]
            paths: ["/collections/*", "/tiles/*", "/tileMatrixSets/*"]

kubectl apply -f authz-cadastral.yaml

Verify: an identity that is not on the allow-list must be denied even over valid mTLS.

kubectl exec -n analytics deploy/adhoc-client -c istio-proxy -- \
  curl -s -o /dev/null -w "%{http_code}\n" \
  http://wfs-feature-engine.cadastral:8080/collections/parcels/items
# expect 403 — verified mTLS, but principal not in the allow-list

# 4. Confirm an authorized cross-domain call still succeeds

Prove the policy admits legitimate traffic. A call from the cross-domain router’s identity, over mTLS, to an allow-listed path must return 200.

kubectl exec -n routing deploy/cross-domain-router -c istio-proxy -- \
  curl -s -o /dev/null -w "%{http_code}\n" \
  "http://wfs-feature-engine.cadastral:8080/collections/parcels/items?bbox=-1.2,52.6,-1.0,52.8&crs=EPSG:4326"
# expect 200 — allow-listed principal, verified mTLS, permitted path

Verify: confirm the request was mutually authenticated end to end, not silently downgraded.

istioctl authn tls-check \
  $(kubectl get pod -n routing -l app=cross-domain-router -o jsonpath='{.items[0].metadata.name}').routing \
  wfs-feature-engine.cadastral.svc.cluster.local
# CLIENT and SERVER must both report STRICT / OK

# Configuration Reference

# Common Failure Modes & Fixes

All cross-domain calls fail with connection reset immediately after applying STRICT. Root cause: a caller workload has no sidecar (not injected) or no valid SVID, so it cannot present a client certificate to the STRICT peer. Fix: confirm injection and restart the caller — kubectl label ns <caller-ns> istio-injection=enabled --overwrite && kubectl rollout restart deploy/<caller> -n <caller-ns>.

istioctl authn tls-check reports CONFLICT. Root cause: a DestinationRule sets tls.mode: DISABLE (or SIMPLE) while PeerAuthentication requires STRICT, so client and server disagree on transport. Fix: align the client side — set the DestinationRule trafficPolicy.tls.mode to ISTIO_MUTUAL for that host.

Authorized identity gets 403 on a path that should be allowed. Root cause: the requested path does not match any operation.paths glob (for example /tileMatrixSets without the trailing segment), so the allow-list does not match and the request is denied. Fix: dump the effective policy and align the path — kubectl get authorizationpolicy -n cadastral -o yaml | grep -A3 paths.

STRICT applied but tls-check still shows PERMISSIVE for the destination. Root cause: a narrower workload-scoped PeerAuthentication (with a selector) is overriding the namespace-wide policy. Fix: list all peer policies in the namespace and remove or align the conflicting selector-scoped one — kubectl get peerauthentication -n cadastral.

Health checks start failing after enabling STRICT. Root cause: kubelet liveness/readiness probes originate outside the mesh and cannot present an SVID, so STRICT resets them. Fix: exclude the probe port from mTLS or use Istio probe rewrite — annotate the pod with sidecar.istio.io/rewriteAppHTTPProbers: "true".

# FAQ

# Related

• Zero-Trust Security for Spatial Endpoints — the parent model this procedure implements
• API Gateway Mapping for GIS Services — the ingress edge that terminates mTLS before internal hops
• Schema Contracts for Vector/Tile Data — payload validation applied once identity is verified
• Spatial Domain Boundary Design — how the domains you are isolating were drawn
• Federated Ownership & Routing Architecture — up one level to the routing architecture overview