Bảo mật Zero-Trust Service Mesh trong Go
🇬🇧 Read the English version of this article on tanhdev.com Trả lời nhanh (Answer-first): Kiến trúc Zero-Trust Go microservices trong Môi trường Dữ liệu Thẻ thanh toán (CDE) loại bỏ hoàn toàn niềm tin dựa trên hạ tầng mạng bằng cách thay thế xác thực IP/token tĩnh bằng định danh workload cryptographic SPIFFE/SPIRE có thể xác minh. By combining kernel-level attestation (Linux cgroups, K8s ServiceAccount, container image SHA256) with short-lived X.509 SVID certificates (rotated automatically in-memory every 1 hour without service restarts), Go microservices and Istio Envoy sidecars establish end-to-end mTLS with strict SAN identity validation. This setup fulfills PCI-DSS 4.0 requirements 3, 4, 6, 7, 8, 10, and 12 with non-repudiable cryptographic audit trails and zero secret sprawl. ...