1 min lesson
WAF, TLS termination and mTLS to origin
Work through the cases in "WAF, TLS termination and mTLS to origin", pairing each signal with the move that fits.
Step 1 of 2
WAF, TLS termination and mTLS to originwhere encryption ends and where trust begins
The figure already covers the hop from edge to origin. The cards add the WAF rule types and the last hop it leaves out: mTLS on every service-to-service call inside the mesh.
Managed rule sets for OWASP Top 10: SQLi, XSS, path traversal.
Custom rules for your shapes: oversized payloads, malformed auth headers, suspicious user agents.
Run in count mode first, then enforce, so you don't 403 real users on day one.
Re-encrypt edge→origin; ideally mTLS so origin only trusts the edge.
Inside the mesh, mTLS again on every service-to-service call.
Open the design by drawing the layers and stating your defense-in-depth posture: "TLS at the edge, WAF and rate limiting before origin, mTLS to origin, mTLS in the mesh." It shows defense in depth, and it frames every later decision as "which layer owns this?"