Zero-trust service authentication

Design a zero-trust service-to-service authentication system for a microservice fleet of 6,000 services across multiple clusters, where every internal call must be mutually authenticated and authorized, no implicit trust from being 'inside the network.' Each workload needs a cryptographic identity, certs must rotate frequently (hours), and a compromised node must not be able to impersonate other services. Target adds <3ms per hop and must not require app-code changes. Cover identity issuance, mTLS enforcement, authorization, and rotation.