3 ms·
I’m giving a talk [1] at SRECon about a tool [2] I’ve written that presents an alternate take one of the major problems that Service Mesh solves - Encrypting in
by GauntletWizard 6y ago
I’m giving a talk [1] at SRECon about a tool [2] I’ve written that presents an alternate take one of the major problems that Service Mesh solves - Encrypting internal traffic. My solution is very simple, to enable your applications to use mutual TLS to authenticate with each other - By making Kubernetes put the certificates in a standard place and making the drop-in middleware so your application can be modified to use them with minimal effort. My point is the same - Service Mesh is great, your middleware already does most of it - The problem is policy and automation, so we’ve solved those for you.
[1] https://www.usenix.org/conference/srecon20americas/presentation/hahn https://www.usenix.org/conference/srecon20americas/presentat...
[2] https://gitlab.com/gauntletwizard_net/kubetls https://gitlab.com/gauntletwizard_net/kubetls
- cyberpunk 6y agoWith istio though, I don't need any motifications. I literally inject the sidecar and everything is mtls'd automatically, the apps just call http:// http:// and the proxy does the rest. Why would I use this over istio?
- GauntletWizard 6y agoWatch my talk and find out :) More seriously, if your istio injector stops working, your app will keep working over plaintext. For some users, that’s a feature. For others, that’s a breach of contract with fines. My app targets the latter.