 ztunnel is a shared resource, it only has access to the keys of the workloads currently on the node it’s running.
Thus, its blast radius is no worse than any other encrypted CNI that relies on per-node keys for encryption.
Also, given the ztunnel’s limited L4 only attack surface area and Envoy’s aforementioned security properties, we feel this risk is limited and acceptable.</p><p>Finally, while the waypoint proxies are a shared resource, they can be limited to serving just one service account.
This 