4 ms·
Does this section on Istio apply to your use-case? > If you want to implement mutual authentication and encryption for workloads, you can use istio auth. Speci
by adamfeldman 9y ago
Does this section on Istio apply to your use-case?
> If you want to implement mutual authentication and encryption for workloads, you can use istio auth. Specifically, for a workload in Kubernetes, Istio auth allows a cluster-level CA to generate and distribute certificates, which are then used for pod-to-pod mutual Transport Layer Security (mTLS).
https://cloud.google.com/security/encryption-in-transit/#service-to-service_and_vm-to-vm_encryption https://cloud.google.com/security/encryption-in-transit/#ser...
- TheIronYuppie 9y agoThat was our intent (though we can always be clearer). If your regulatory environment requires that level of encryption, you'll want to use something, like Istio, that provides pod-to-pod mTLS (likely via a proxy or service mesh or both). Disclosure: I work at Google on Kubeflow
- theptip 9y agoMy use-case is currently quite simple (very few services) and so getting a TLS cert into each pod is easy enough. (I use the cluster CA to manually provision certs for the small number of private services that I have, and Acme certs for all of my publicly accessible services). As I roll out more services I've definitely got my eye on Istio, since auto-provisioned mTLS certs will be very useful. It does seem a bit bleeding edge though; it's only on version 0.3.