Securing Microservices: mTLS in Kubernetes

In a Zero Trust network, we assume the network is hostile. This means Pod-to-Pod communication inside Kubernetes must be encrypted.

Implicit vs Explicit mTLS

Managing certificates manually is impossible. We use a Service Mesh (Linkerd or Istio).

flowchart LR
    ServiceA[Service A] -- HTTP --> ProxyA[Linkerd Proxy]
    ProxyA -- mTLS (HTTPS) --> ProxyB[Linkerd Proxy]
    ProxyB -- HTTP --> ServiceB[Service B]
    
    style ProxyA fill:#E1F5FE
    style ProxyB fill:#E1F5FE

The application code (Service A) knows nothing about encryption. It talks to `localhost`. The proxy intercepts and upgrades the connection to mTLS.