mTLS Between Services
What is mutual TLS (mTLS) in a service mesh, and what problem does it solve versus plain TLS to clients?
Answers use simple, clear English.
Quick interview answer
mTLS authenticates both client and server with certificates, encrypting traffic. In meshes (Istio/Linkerd), sidecars automate cert issuance/rotation so east-west traffic is authenticated without app code changes. It reduces reliance on a flat trusted network.
Detailed answer
mTLS authenticates both client and server with certificates, encrypting traffic. In meshes (Istio/Linkerd), sidecars automate cert issuance/rotation so east-west traffic is authenticated without app code changes. It reduces reliance on a flat trusted network. Still need authorization (SPIFFE IDs → policies); encryption alone is not authz.
Full explanation
Still need authorization (SPIFFE IDs → policies); encryption alone is not authz.
Real example & use case
Payments service only accepts calls from the checkout workload identity, rejecting a compromised batch job's pod.
Pros & cons
Pros: strong service identity. Cons: cert ops complexity without a mesh/platform.