Zero-trust & workload identity

Incorrect — That is the perimeter model zero trust replaces.

Incorrect — Zero trust covers east-west too.

Incorrect — The opposite — it authenticates everything.

Incorrect — A network appliance, not the zero-trust perimeter.

Incorrect — Physical/network boundaries are what zero trust stops trusting.

Incorrect — Not the basis for trust decisions.

Incorrect — It drives stronger controls, not surrender.

Incorrect — You log more, not less.

Incorrect — Assume-breach explicitly distrusts internal traffic.

Incorrect — It eliminated reliance on the VPN/perimeter.

Incorrect — Far broader than that.

Incorrect — It is an access architecture, not a firewall.

Incorrect — Cost is not the core failure.

Incorrect — They can; the model itself is the problem.

Incorrect — Performance is not the reason.

Incorrect — IPs are exactly what zero trust stops trusting.

Incorrect — Shared secrets are the opposite of per-workload identity.

Incorrect — A network control, not an identity.

Incorrect — Not a security consideration.

Incorrect — They are not; that is not the difference.

Incorrect — Identity is precisely what you verify.

Incorrect — That is the permissive model zero trust rejects.

Incorrect — Zero trust is policy-heavy by design.

Incorrect — A namespace is not a trust boundary here.

Incorrect — That is the standing-trust model zero trust avoids.

Incorrect — The opposite.

Incorrect — Unrelated to continuous verification.

Incorrect — Workloads need strong identity too.

Incorrect — Users need it as well.

Incorrect — Location is exactly what is not trusted.

Incorrect — Not a zero-trust pillar.

Incorrect — A narrow control, not a pillar.

Incorrect — Static trust zones are what it replaces.

Incorrect — That risks breaking everything at once.

Incorrect — It is an architecture, not a product.

Incorrect — The goal is verified access, not no access.

Incorrect — Unrelated to SPIFFE.

Incorrect — Not a network filter.

Incorrect — It issues identity, not stores secrets.

Incorrect — It is a URI, not an email.

Incorrect — It is a structured URI, not a bare UUID.

Incorrect — Identity is deliberately not an IP.

Incorrect — Not a policy object.

Incorrect — Unrelated to images.

Incorrect — It is a credential, not a log.

Incorrect — Related idea but not the SPIFFE concept.

Incorrect — Not a network range.

Incorrect — It is an identity trust boundary, not a group.

Incorrect — Unrelated.

Incorrect — Not a pipeline tool.

Incorrect — It issues identity, not metrics.

Incorrect — Irrelevant to attestation.

Incorrect — That is closer to workload attestation, and node attestation is about the node.

Incorrect — Not a credential check.

Incorrect — Selectors are richer and harder to spoof than IP.

Incorrect — Not how SPIRE attests workloads.

Incorrect — Attestation uses selectors, not DNS.

Incorrect — Unrelated to identity.

Incorrect — Not its function.

Incorrect — It provides identity, not networking.

Incorrect — That is the anti-pattern SPIFFE avoids.

Incorrect — They are fetched at runtime, not baked in.

Incorrect — Each workload gets its own identity.

Incorrect — They suit different transports.

Incorrect — They are short-lived like X.509-SVIDs.

Incorrect — They are certificates, not passwords.

Incorrect — It provides identity, not networking.

Incorrect — It underpins authorization; it does not remove it.

Incorrect — Not its purpose.

Incorrect — Not what a registration entry does.

Incorrect — Not credential storage.

Incorrect — Not a networking mapping.

Incorrect — It secures traffic in transit, not storage.

Incorrect — Not a mesh function.

Incorrect — It adds service-to-service authz, distinct from K8s RBAC.

Incorrect — That is ordinary TLS; mutual means both sides.

Incorrect — mTLS is certificate-based.

Incorrect — It uses certificates, not passwords.

Incorrect — That is PERMISSIVE mode, used during migration.

Incorrect — The opposite — it mandates it.

Incorrect — It governs service-to-service (east-west) traffic.

Incorrect — They use a structured identity.

Incorrect — Identity is deliberately not the IP.

Incorrect — Not used for mesh identity.

Incorrect — That is a secrets manager.

Incorrect — A separate mesh function, not the CA.

Incorrect — Unrelated to the CA.

Incorrect — Size is not the security property.

Incorrect — They are issued by the mesh CA.

Incorrect — They are the basis of mTLS.

Incorrect — That can break plaintext clients abruptly.

Incorrect — That removes the security you want.

Incorrect — Contrary to the goal.

Incorrect — It keeps mTLS/identity, just without per-pod sidecars.

Incorrect — It still secures east-west.

Incorrect — It remains transparent to apps.

Incorrect — Performance is not the issue.

Incorrect — Trusting the interior is the classic mistake.

Incorrect — Not the concern.

Incorrect — IP is spoofable and churns; the mesh uses identity.

Incorrect — Not the mesh identity mechanism.

Incorrect — Names are not a cryptographic identity.

Incorrect — The mesh removes that burden.

Incorrect — It enables identity-based authz.

Incorrect — It is language-agnostic.

Incorrect — Not the identity basis.

Incorrect — No shared secret; per-workload certs.

Incorrect — Deliberately not the IP.

Incorrect — Identity-based authz avoids relying on IP.

Incorrect — Irrelevant to authorization.

Incorrect — Not an authz input.

Incorrect — That is default-allow, the opposite.

Incorrect — Unrelated to encryption.

Incorrect — It governs east-west authz.

Incorrect — That maximizes lateral movement.

Incorrect — Too coarse; scope per workload.

Incorrect — Contrary to zero trust.

Incorrect — That is L4; L7 goes further.

Incorrect — Not an authz dimension.

Incorrect — Irrelevant to authz.

Incorrect — Not a JWT concern.

Incorrect — Unrelated to JWT validation.

Incorrect — Not a request auth input.

Incorrect — They authorize different things and compose.

Incorrect — The value is security, not speed.

Incorrect — Unrelated.

Incorrect — Error-prone and unauditable.

Incorrect — Defeats the purpose.

Incorrect — Not reproducible or reviewable.

Incorrect — IP-based rules break as pods churn.

Incorrect — It does not control scheduling.

Incorrect — That would be stale and wrong.

Incorrect — That breaks every undocumented flow at once.

Incorrect — Default-deny is the zero-trust target.

Incorrect — Testing is exactly what prevents the outage.

Incorrect — They operate at different layers.

Incorrect — That is RBAC; the mesh governs data-plane traffic.

Incorrect — It is a key east-west control.

Incorrect — That would be the no-policy case.

Incorrect — Not an automatic effect of authz.

Incorrect — The mesh keeps enforcing, not shutting down.

Incorrect — Encryption (mTLS) is necessary but not sufficient; you also authorize.

Incorrect — Co-location is not a trust basis.

Incorrect — Namespaces are not a trust boundary.

Incorrect — Federation exchanges public trust bundles, not private keys.

Incorrect — Federation keeps domains separate but interoperable.

Incorrect — It extends authentication across domains.

Incorrect — Federation is for spanning multiple domains.

Incorrect — Unrelated to federation.

Incorrect — Not its purpose.

Incorrect — Sharing private keys would break the trust model.

Incorrect — SVIDs are issued per workload, not bulk-shared.

Incorrect — Irrelevant to federation.

Incorrect — That is the open-egress risk zero trust closes.

Incorrect — Egress is about outbound control.

Incorrect — Not what egress control does.

Incorrect — That is an ingress gateway.

Incorrect — Not its function.

Incorrect — Unrelated.

Incorrect — Lateral movement and exfiltration are east-west/egress.

Incorrect — Assume-breach says otherwise.

Incorrect — It can, via gateways and policy.

Incorrect — Short lifetimes largely obviate CRLs.

Incorrect — Expiry is exactly how it revokes.

Incorrect — Not required for revocation.

Incorrect — Federation connects them without merging.

Incorrect — The opposite — you extend mTLS across them.

Incorrect — Contrary to zero trust.

Incorrect — Posture is broader than a schedule.

Incorrect — A weak, spoofable signal alone.

Incorrect — Posture adds important context to identity.

Incorrect — They align; meshes use SPIFFE-style identity.

Incorrect — They are complementary layers.

Incorrect — Identity is what the mesh enforces.

Incorrect — Only public trust bundles are exchanged.

Incorrect — Unnecessary and undesirable.

Incorrect — A flat network is the perimeter model zero trust rejects.

Incorrect — Zero trust stops trusting the network.

Incorrect — The perimeter model is what this replaces.

Incorrect — Encryption plus identity and authorization is the point.