skills.rest
hung-phan
hung-phanCOMMUNITY
Explore all skills by this author →
GitHub

zero-trust

Implement Zero Trust architecture with SPIFFE, SPIRE, and mTLS.

Updated Jun 5, 2026
Search Tags:#security architecture#service mesh#mTLS#policy enforcement#zero trust#workload identity
One-click install
npx skills add https://github.com/hung-phan/system-skills --skill zero-trust-hung-phan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zero-trust
Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/zero-trust
Command: npx skills add https://github.com/hung-phan/system-skills --skill zero-trust-hung-phan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you design and implement Zero Trust security architecture, ensuring that every call is authenticated and authorized, and data is encrypted at every hop.

Core Features & Use Cases

  • Zero Trust Principles: Emphasizes the five tenets of Zero Trust, including never trusting the network, authenticating every call, authorizing every call, encrypting every hop, and attesting and rotating identity.
  • BeyondCorp: Provides guidance on implementing BeyondCorp, a Zero Trust approach for humans, focusing on device enrollment, user authentication, and application access.
  • SPIFFE and SPIRE: Offers insights into using SPIFFE (Secure Production Identity Framework for Everyone) and SPIRE (SPIFFE Runtime) for workload identity.
  • Policy Enforcement: Discusses implementing policy enforcement points (PEPs) and policy decision points (PDPs) for per-request authorization.
  • Service Mesh: Explores the use of service mesh technologies like Istio, Linkerd, and Consul Connect as a Zero Trust substrate.

Quick Start

Use the zero-trust skill to learn about the core principles of Zero Trust and how to implement them in your organization.

Frequently Asked Questions about zero-trust

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement zero trust security architecture in microservices?▼

Implement zero trust architecture in microservices by using a service mesh like Istio to authenticate every call, authorize requests via policy enforcement points, and encrypt data at every hop with mTLS.

What are the core principles of a zero trust network model?▼

The core principles of a zero trust network include never trusting the network, authenticating and authorizing every call, encrypting every hop, and continuously attesting and rotating workload identity.

Do I need SPIFFE and SPIRE to manage workload identity in cloud environments?▼

You need SPIFFE and SPIRE to manage workload identity in cloud environments by securely attesting, issuing, and rotating cryptographic identities that authenticate every service call.

How does mTLS policy enforcement work in a service mesh?▼

mTLS policy enforcement in a service mesh works by intercepting traffic to encrypt every hop, while policy decision points evaluate workload identity to authorize per-request access.

Can I use BeyondCorp for zero trust user access instead of a VPN?▼

You can use BeyondCorp for zero trust user access by replacing traditional VPNs with device enrollment, strict user authentication, and context-aware application access controls.

Related Skills

Explore More Software Engineering Skills→
williamzujkowskiwilliamzujkowski
17

zero-trust-security

Implement zero-trust security with mTLS and SPIFFE/SPIRE in Kubernetes.

Community
Advanced
jamesogunsanjamesogunsan

linkerd-patterns

Automate Linkerd service mesh deployment and configuration in Kubernetes environments.

Community
Intermediate
RedHatProductSecurityRedHatProductSecurity
47

service-to-service-mtls

Implement SPIFFE/SPIRE and mTLS protocols for mutual service authentication.

Official
Advanced
SSiertsemaSSiertsema

zero-trust-architecture

Design zero-trust architectures with per-request authentication, authorization, and encryption.

Community
Advanced