Why should you care?

CloudVerse healthcare APIs require auth even east-west between microservices.

See it live — copy this example

Use AWS/Azure/GCP free tier or local Docker/Kind. Sketches and YAML are meant to be typed and adapted.

# Zero trust flow (CloudVerse clinic API)
# User → Entra ID MFA → App Gateway JWT validate
# Service → mTLS via service mesh (SPIFFE IDs)
# Policy: deny all, allow explicit RBAC + network policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-except-billing
spec:
  podSelector: { matchLabels: { app: billing-api } }
  policyTypes: [Ingress, Egress]
  ingress:
  - from: [{ podSelector: { matchLabels: { app: gateway } } }]

What happened?

• Micro-segmentation, strong identity, and continuous validation replace “inside VPN = safe”.
• Follow the steps below — typing the code yourself is the fastest way to learn.

Practice next

1. Map one user journey with auth points.
2. Enable mTLS between two services.
3. Add default-deny network policy.
4. Add Conditional Access for admin portals.
5. Use private endpoints for PaaS.

Remember

Never trust, always verify. mTLS east-west. Explicit allow rules.

CloudVerse clinic segment

Compromised web pod tries lateral move.

Outcome: NetworkPolicy blocks reach to PHI database.