https://marktaguiad.dev/tags/mtls/ Recent content in Mtls on marktaguiad.dev Hugo en-us marktaguiad@marktaguiad.dev (Mark Taguiad) marktaguiad@marktaguiad.dev (Mark Taguiad) marktaguiad.dev Tue, 24 Mar 2026 00:00:00 +0000 https://marktaguiad.dev/post/k8s-istio-dos/ Tue, 24 Mar 2026 00:00:00 +0000marktaguiad@marktaguiad.dev (Mark Taguiad) https://marktaguiad.dev/post/k8s-istio-dos/ <p>Continuation of Kubernetes Istio, this time we&rsquo;ll focus on Security.</p> <h1 id="table-of-contents">Table of Contents</h1> <nav id="TableOfContents"> <ol> <li><a href="#security">Security</a> <ol> <li><a href="#mtls-mutual-tls">mTLS (Mutual TLS)</a></li> <li><a href="#authorizationpolicy-rbac">AuthorizationPolicy (RBAC)</a></li> </ol> </li> </ol> </nav> <h3 id="security">Security</h3> <h4 id="mtls-mutual-tls">mTLS (Mutual TLS)</h4> <p>This will ensure that service-to-service traffic is encrypted and authenticated.</p> <p>Istio allows you to configure three main modes per namespace, workload, or globally:</p> <table> <thead> <tr> <th>Mode</th> <th>Behavior</th> <th>When to Use</th> </tr> </thead> <tbody> <tr> <td><strong>STRICT</strong></td> <td>Only allows <strong>mTLS-encrypted traffic</strong>. Plain HTTP connections are rejected.</td> <td>Best for production when you want <strong>full security</strong> between services.</td> </tr> <tr> <td><strong>PERMISSIVE</strong></td> <td>Accepts both mTLS-encrypted and plain HTTP traffic.</td> <td>Useful during <strong>gradual migration</strong> to mTLS. Old workloads can still communicate without encryption.</td> </tr> <tr> <td><strong>DISABLE</strong></td> <td>Does not use mTLS at all.</td> <td>For testing, legacy workloads, or non-critical traffic.</td> </tr> </tbody> </table> <p>You might get confused with the HTTPS traffic, it just mean that all traffic are converted by istio envoy to mTLS. So as long as the request is going through first the sidecar then it is valid.</p>