The cluster boots. Services blink awake. A mesh forms between them, invisible yet binding. At its core sits the Provisioning Key — one token to rule entry, identity, and trust. Without it, nothing connects. With it, the mesh lives.
A Provisioning Key in a service mesh is the critical credential issued to workloads as they join the network. It is generated by the control plane and consumed by sidecars or proxies to establish secure channels between services. This key carries the identity data that lets a service prove who it is to others. Every handshake, every packet, depends on that proof.
Provisioning is more than a one-time step. Keys must rotate. Expired keys must be revoked. New workloads must join without delay. If the mesh misses a beat, services stall or fail. The process must be automated, fast, and auditable. That means standing up endpoints for secure key distribution, limiting scope with short-lived tokens, and storing nothing in plaintext.
In most modern deployments, the Provisioning Key is bound tightly to mTLS certificates managed by the mesh. Service meshes like Istio, Linkerd, or Consul coordinate these exchanges through their control planes. Provisioning Keys trigger certificate signing requests, which issue workload identities. Once accepted, the data plane nodes encrypt traffic with zero trust principles. The moment a service leaves, its key dies.