In this lesson, you will learn how to enforce mutual TLS (mTLS) within a service mesh to ensure that every request between your microservices is both encrypted and cryptographically authenticated.
The Problem with Default Communication
By default, Kubernetes pods communicate over the network in cleartext. Even if your edge traffic is secured with HTTPS at the ingress, internal "east-west" traffic remains vulnerable to sniffing or unauthorized service impersonation. Manually managing certificates for every service is an operational nightmare.
Enforcing mTLS via Service Mesh
A service mesh solves this by injecting a sidecar proxy (like Envoy) alongside your application containers. When mTLS is enabled, the control plane automatically provisions and rotates identity certificates for each proxy. Instead of your application handling TLS handshakes, the sidecars perform a "mutual" handshake: Service A verifies Service B's identity, and Service B verifies Service A's identity, all before any application data is sent.
To enforce this globally in a mesh like Istio, you define a PeerAuthentication policy. This tells the sidecars to reject any non-TLS traffic:
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: default
namespace: istio-system
spec:
mtls:
mode: STRICT
Why "Strict" Mode?
Setting the mode to STRICT is the final step in securing your cluster. It ensures that the sidecar proxies only accept encrypted connections. If a service attempts to send plain HTTP traffic, the connection will be dropped immediately. This provides a "Zero Trust" posture where you no longer rely on network-level security (like IP whitelisting), but rather on cryptographic identity verified at the application layer.
Because this is handled by the sidecar, your application code remains completely unaware of the encryption. It continues to talk to localhost or the service name via HTTP, while the mesh manages the secure transport underneath. This seamless integration allows you to achieve high-security compliance without forcing your developers to manage complex PKI infrastructure.
Key Takeaway: mTLS via service mesh sidecars provides an automated, zero-trust layer that guarantees encrypted, authenticated communication between services without modifying a single line of application code.