Traefik Mesh ACL mode transition for internal service isolation

Answer to the core question

When ACL mode is enabled ( mesh.acl.enabled: true ), Traefik Mesh enforces a deny‑by‑default policy on **all** traffic that passes through the Envoy sidecar. This includes traffic that resolves to a headless service DNS name and traffic that targets a pod’s IP directly. The sidecar intercepts every packet destined for the pod’s IP address (the pod’s network namespace) via iptables rules, so the ACL engine evaluates the request before it reaches the application container.

Therefore, as long as the pod is part of the mesh and the sidecar is running, there is no security gap: even direct pod‑to‑pod communication is subject to the ACL rules. The only way to bypass ACL enforcement is to send traffic that never enters the sidecar—e.g., using host‑networking or bypassing the pod’s IP entirely.

Key assumptions

• All target pods have a sidecar injected (default in Traefik Mesh).
• The pod’s network namespace is reachable via the pod IP (the default Kubernetes networking model).
• Traefik Mesh version is 0.14+ where ACL mode is fully supported.

Practical steps to confirm enforcement

1. Enable ACL mode in traefik-mesh.yaml:

   mesh:
     acl:
       enabled: true
   

2. Define an ACL policy that allows traffic from Service A to Service B:

   apiVersion: traefik.io/v1alpha1
   kind: TrafficTarget
   metadata:
     name: allow-a-to-b
   spec:
     source:
       kind: Service
       name: service-a
     destination:
       kind: Service
       name: service-b
     rules:
       - action: allow
   

3. Apply the policy:

   meshctl apply -f traffic-target.yaml
   

4. Verify the policy is active:

   meshctl get acl
   

5. Test traffic:
   • From a pod in Service A, send a request to service-b.default.svc.cluster.local (headless DNS).
   • Send another request directly to the pod IP of Service B (e.g., 10.244.1.23:8080).
   • Check the Envoy access log on the Service A pod; a 200 OK indicates the ACL allowed the request, while a 403 Forbidden or connection reset indicates denial.
6. Check sidecar logs for ACL evaluation messages if the request is denied.

Potential edge cases

• If a pod uses hostNetwork: true, the sidecar does not intercept traffic, and ACLs will not apply.
• Missing or mismatched labels on services can cause ACL rules to not match, unintentionally denying traffic.
• Traffic that bypasses the pod IP entirely (e.g., using a different namespace’s DNS or an external IP) is outside the scope of the sidecar and therefore not governed by the ACL.

Diagnostic question

To ensure the recommendation applies, could you confirm that the pods you are testing are running the Traefik Mesh sidecar and are not using hostNetwork?