What proves who is calling?
Bad: Its IP address
Pods churn and IPs get reused. Tomorrow it may be another workload.
Good: A certificate per workload
Verify every call as if it came from the internet.
In mutual TLS, both sides prove they hold their key.
Each signs a transcript of this very handshake, nonces included. A recorded handshake is useless to replay, and no secret crosses the wire.
12 h
the most a stolen certificate is worth
Revocation is classic PKI’s weak spot, so workload certificates live hours. Renew at half-life, and a broken CA still has 6 hours before anything expires.
Fetching a credential takes a secret. Who gives a new pod its first secret?
The trick
Nobody. It asks a local agent “who am I?”, presenting nothing. The agent identifies it via the kernel and kubelet.
Let the mesh do mTLS, without breaking callers
- Server joins in PERMISSIVE: accepts mTLS and plaintext
- Clients join; their sidecars switch to mTLS
- Wait until metrics show zero plaintext
- Flip to STRICT, namespace by namespace
mTLS everywhere. Done?
Bad: Any valid certificate gets in
A compromised reports pod still proves it’s reports: the flat network, encrypted.
Good: Default deny, per method
Each receiver admits named callers only: “checkout may POST /v1/charges”.
Payments checks two proofs that must agree.
mTLS proves orders is calling. A token exchanged for this hop, addressed to payments, says orders acts for user u_42.
Remember
Trust no network. Each workload proves who it is over mTLS with a short-lived certificate; default-deny policy decides what it may call; a per-hop token carries the user.