Zero Trust Access (ZTA)
Zero Trust is a security framework based on the principle of “Never Trust, Always Verify.” It removes the traditional “permissive perimeter” (like a VPN) and instead validates every single request to every single resource.
🗝️ Core Principles
- Verify Explicitly: Always authenticate and authorize based on all available data points (identity, location, device health).
- Least Privilege: Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA).
- Assume Breach: Minimize blast radius and segment access.
🏢 Implementation Pattern: Identity-Aware Proxy (IAP)
IAP is the modern replacement for VPNs. It places a proxy in front of an application that enforces identity checks before the application is ever reached.
Patterns:
- Cloudflare Access: Gates web applications at the edge.
- Teleport: Provides identity-aware access for SSH, Kubernetes, Databases, and Web apps.
- Google IAP: Part of BeyondCorp, used to protect internal GCP resources.
📄 Case Study: Gating Static Content
In the Digital Brain Project, we use Cloudflare Access to protect a /private/ folder. This is a powerful pattern for:
- Internal Wikis: Making technical knowledge public while keeping sensitive post-mortems or client data private.
- Staging Environments: Preventing leak of pre-release features to the public web.
- Admin Dashboards: Adding a layer of security over legacy tools without modifying their code.
🎡 Kubernetes Network Policies: Zero-Trust Inside the Cluster
Traditional Zero Trust focuses on north-south traffic (user → application). Kubernetes NetworkPolicies extend the same philosophy to east-west traffic (Pod → Pod) inside the cluster:
- Default deny all ingress/egress per namespace
- Explicitly whitelist only required communication paths (e.g.,
frontend→backendon port 80,backend→databaseon port 3306) - Label-based identity — no reliance on IP addresses that change with every Pod restart
This prevents a compromised workload from laterally moving to sensitive services. See Kubernetes Network Policies for the full CNI support matrix, default deny patterns, and CKA exam guidance. Source: CKA Day 26
Last Updated: 2026-07-06