Layer 3 · Go deeper · 9 min
Go deeper
Size it, build it, then make the calls an interviewer will push you on.
Back of the envelope
Size it up
Tap through each step of the arithmetic.
What does a sidecar mesh cost at 20,000 internal requests a second?
What do fresh mTLS handshakes cost at 5,000 requests a second?
Build-up · 7 steps
The mutual TLS 1.3 handshake
Orders calls payments for the first time. Step through TLS 1.3 and watch for the messages that make it mutual.
Step 1 of 7
Orders says hello
Orders opens with a random nonce, its cipher suites and a Diffie–Hellman key share, so both sides can agree keys after a single reply.
4 interview moments
You’re the candidate
The interviewer pushes on the hard parts. Pick an approach and see how it holds up.
Deep dive 1 of 4
Interviewer
“Inside one cluster, services must prove to each other which one is calling. What do you use?”
Your move. Pick an approach:
Deep dive 2 of 4
Interviewer
“Your internal CA issues workload certificates. How long should they live, and how do you kill a stolen one?”
Your move. Pick an approach:
Deep dive 3 of 4
Interviewer
“STRICT mTLS is on everywhere. Then the reports service is compromised. What stops it writing to the ledger?”
Your move. Pick an approach:
Deep dive 4 of 4
Interviewer
“Orders calls payments for customer u_42. How does payments learn which customer the call is for?”
Your move. Pick an approach:
Build-up · 7 steps
How a workload gets its identity
The pod is given no secret in advance. SPIRE proves the node first, then the process that asks, and streams renewals before expiry.
Step 1 of 7
The agent proves its node
The agent sends the SPIRE server, the signing authority for one trust domain, proof only its machine could have: an AWS instance identity document or a Kubernetes service account token.