AKS standards

Question

AKS standards

nikita tiwari 25

We are developing our AKS standards, and as part of this, we want to implement mTLS between microservices and isolate workloads between namespaces. We plan to use Istio as the service mesh and Cilium to create network policies for better performance. Has anyone done this before? Is it overkill, or is there a better way to implement it?

Himanshu Shekhar 6,710 Reputation points Microsoft External Staff Moderator

2025-09-01T10:29:40.58+00:00
Hi nikita tiwari

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Please help us with below queries for better understanding:

Are all namespaces going to require end-to-end mTLS, or only select workloads (e.g., PII, payment)?

How many services/pods do you expect long-term? Also, does your team prefer the managed add-on route, or customized control with upstream Istio?

Additionally, few suggested links shared for reference below:

This explains through how to secure microservices on AKS using both Istio service mesh and Cilium: https://techcommunity.microsoft.com/blog/azurenetworkingblog/securing-microservices-with-cilium-and-istio/4381646

This provides managed, supported integration of Istio with AKS, including lifecycle management, scaling, and compatibility testing https://learn.microsoft.com/en-us/azure/aks/istio-about

This covers control-plane resource usage (Istiod) and its capacity to handle large numbers of sidecars and churn rates also https://docs.azure.cn/en-us/aks/istio-scale

Kindly let us know if the suggested steps helps or you need further assistance on this issue.

Regards

Himanshu
Himanshu Shekhar 6,710 Reputation points Microsoft External Staff Moderator

2025-09-03T12:37:00.6566667+00:00

Hi nikita tiwari

Could you please provide an update on this post?

Kindly let us know if the suggested steps helps or you need further assistance on this issue.
Himanshu Shekhar 6,710 Reputation points Microsoft External Staff Moderator

2025-09-08T09:27:19.42+00:00

Hi nikita tiwari

Could you please provide an update on this post?

Kindly let us know if the suggested steps helps or you need further assistance on this issue.

1 answer

Your answer

Himanshu Shekhar 6,710 Reputation points Microsoft External Staff Moderator

2025-09-01T10:29:40.58+00:00

Hi nikita tiwari

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Please help us with below queries for better understanding:

Are all namespaces going to require end-to-end mTLS, or only select workloads (e.g., PII, payment)?

How many services/pods do you expect long-term? Also, does your team prefer the managed add-on route, or customized control with upstream Istio?

Additionally, few suggested links shared for reference below:

This explains through how to secure microservices on AKS using both Istio service mesh and Cilium: https://techcommunity.microsoft.com/blog/azurenetworkingblog/securing-microservices-with-cilium-and-istio/4381646

This provides managed, supported integration of Istio with AKS, including lifecycle management, scaling, and compatibility testing https://learn.microsoft.com/en-us/azure/aks/istio-about

This covers control-plane resource usage (Istiod) and its capacity to handle large numbers of sidecars and churn rates also https://docs.azure.cn/en-us/aks/istio-scale

Kindly let us know if the suggested steps helps or you need further assistance on this issue.

Regards

Himanshu
Himanshu Shekhar 6,710 Reputation points Microsoft External Staff Moderator

2025-09-03T12:37:00.6566667+00:00

Hi nikita tiwari

Could you please provide an update on this post?

Kindly let us know if the suggested steps helps or you need further assistance on this issue.
Himanshu Shekhar 6,710 Reputation points Microsoft External Staff Moderator

2025-09-08T09:27:19.42+00:00

Hi nikita tiwari

Could you please provide an update on this post?

Kindly let us know if the suggested steps helps or you need further assistance on this issue.

Answer 1

Hi @Nikita Tiwari

Using Istio for mTLS and Cilium for network policies is a strong choice for securing microservices in AKS, especially when advanced features and strict security are paramount. However, it's essential to weigh the benefits against the added complexity and overhead, considering simpler alternatives if basic isolation is sufficient.

First Argument: Istio provides comprehensive service mesh features, including mTLS, traffic management, observability, and security policies, enhancing security and control over microservice communication.
Second Argument: Cilium offers advanced, identity-based network policies with high performance using eBPF, improving upon standard Kubernetes Network Policies.
Third Argument: The combination of Istio and Cilium allows for granular control over both service-to-service authentication and network-level isolation, crucial for meeting stringent security requirements.

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.

Share via

AKS standards

1 answer

Your answer