What problem does it solve? Securing internal service-to-service traffic with mutual TLS is complex: teams must manage certificate hierarchies, configure mesh-wide policies, rotate credentials, and debug opaque TLS handshake failures. This Skill provides ready-to-use templates and operational guidance for implementing mTLS correctly. ## Core Features & Use Cases - Service Mesh Templates: Production-ready YAML for Istio PeerAuthentication, DestinationRules, and Linkerd automatic mTLS, including STRICT and PERMISSIVE migration modes. - Certificate Management: Cert-manager integration, SPIFFE/SPIRE workload identity setup, and certificate rotation procedures with short-lived workload certs. - Debugging & Compliance: Commands for verifying mTLS status, inspecting certificate expiry, and troubleshooting TLS handshakes, supporting PCI-DSS and HIPAA requirements. - Use Case: When migrating a Kubernetes cluster to zero-trust networking, apply the PERMISSIVE-to-STRICT Istio templates, wire cert-manager as the CA, and use the debugging commands to verify every workload negotiates mTLS before enforcing strict mode. ## Quick Start Ask the agent to generate an Istio PeerAuthentication policy that enables strict mTLS for the payment-service workload in the production namespace.
