Integrating HashiCorp Vault with Consul for Service Mesh Security

Act as a Service Mesh Security Architect. Write a highly technical, end-to-end integration manual detailing the fusion of HashiCorp Vault with a Consul Service Mesh to mathematically guarantee a true 'Zero Trust Network' at the pod/container level. The absolute focus is configuring Vault to act as the supreme Certificate Authority (CA) backend for Consul Connect. Detail exactly how to orchestrate the [SERVICE_MESH_ARCHITECTURE] (e.g., Kubernetes sidecar injection) to force Consul to utilize Vault for the automated issuance and rotation of [MTLS_MODE] (strict mutual TLS) certificates securing all [TRAFFIC_PROTOCOL] (e.g., gRPC or HTTP/2) traffic between microservices. Provide the exact, flawless `consul-template` HCL configuration file required to handle the dynamic, in-memory secret injection for the Envoy sidecar proxies, guaranteeing that unencrypted keys are never written to the container's disk.