mTLS Between Services
What is mutual TLS (mTLS) in a service mesh, and what problem does it solve versus plain TLS to clients?
Answers use simple, clear English.
Audio N/AQuick interview answer
mTLS authenticates both client and server with certificates, encrypting traffic. In meshes (Istio/Linkerd), sidecars automate cert issuance/rotation so east-west traffic is authenticated without app code changes. It reduces reliance on a flat trusted network.
Detailed answer
mTLS authenticates both client and server with certificates, encrypting traffic. In meshes (Istio/Linkerd), sidecars automate cert issuance/rotation so east-west traffic is authenticated without app code changes. It reduces reliance on a flat trusted network. Still need authorization (SPIFFE IDs → policies); encryption alone is not authz.
Full explanation
Still need authorization (SPIFFE IDs → policies); encryption alone is not authz.
Real example & use case
Payments service only accepts calls from the checkout workload identity, rejecting a compromised batch job's pod.
Pros & cons
Pros: strong service identity. Cons: cert ops complexity without a mesh/platform.