Zero Trust is the right architecture. But retrofitting mutual TLS into a live 40-service environment without a deployment freeze requires a strategy, not a mandate.
Why Retrofitting mTLS Is Hard
Microservices that evolved organically rarely have clean service identity. Certificates expire. Certificate rotation must be automated, or you've traded one failure mode for another.
Service Mesh Selection: Istio vs Linkerd vs Cilium
Istio provides the most complete feature set but has significant operational complexity. Linkerd trades features for simplicity. Cilium operates at the eBPF layer — the right choice if you need fine-grained network policy without sidecar overhead.
Zero TrustmTLSMicroservicesService MeshIstio