Mutual TLS

The Problem mTLS Solves

 inside the perimeter, services historically talked plaintext:

 - any pod compromise → sniff/impersonate anything
 - no SERVICE identity: "is this really orders calling me?"
 - zero-trust mandates (SOC2/PCI) demand encryption in transit,
   everywhere, including east-west

 MUTUAL TLS: both sides authenticate via certificates:

 [orders sidecar]═══TLS(mTLS)═══[billing sidecar]
   cert: spiffe://acme/ns/prod/sa/orders
   cert: spiffe://acme/ns/prod/sa/billing
   → encrypted + mutually verified identities ✓

How Meshes Make It Painless

 without mesh: cert issuance/renewal/distribution per service
 = a graveyard of expired-cert incidents. with mesh:

 1. CONTROL PLANE acts as CA (or delegates to cert authority)
 2. each proxy receives short-lived certs automatically
 3. rotation happens continuously WITHOUT app awareness
    (istio default: 24h certs, auto-renewed)
 4. apps keep speaking plaintext to localhost; proxies wrap

 SPIFFE identity model:
   spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>
   → workload identity that AUTHZ POLICIES reference:
     "billing accepts calls ONLY from sa/orders in ns/prod"

The Rollout Dance

 enabling mTLS across a mixed fleet:

 PERMISSIVE mode: accept BOTH plaintext and mTLS
   → fleet migrates gradually; nothing breaks ✓
 then STRICT mode: mTLS only; plaintext rejected.

 sequence that works:
 □ mesh-wide PERMISSIVE on day one
 □ verify all caller pairs show TLS metrics climbing
 □ namespace-by-namespace STRICT (canary namespaces first)
 □ fleet STRICT; alert on any plaintext attempts remaining

 authorization policies ride the same rails — once identity
 exists, service-to-service ALLOWLISTS become declarative:
 default-deny + explicit grants = zero-trust posture.

Operational Notes That Bite

Issue	Reality
Cert expiry storms	shouldn’t happen (auto-renew) — monitor renewal failures anyway
Trust-domain migration	painful; plan before multi-cluster merges
Clock skew	breaks validity windows; NTP is security infra now
Non-mesh callers	external clients need gateway path or cert issuance
Debugging	openssl s_client against proxy ports; envoy logs

 performance note: modern TLS resumption + session reuse
 make mTLS overhead modest (~single-digit % typically).
 measure rather than fear it.

Interview Framing

“Compliance requires encryption between all internal services” scored shape: mTLS-via-mesh as the answer with SPIFFE identity explained, permissive→strict rollout dance shown, authz-policies-on-top mentioned (identity enables allowlisting), operational gotchas named (trust domain, non-mesh callers), overhead honesty. This question appears in every compliance-adjacent interview — the rollout sequencing detail is what distinguishes operators from checkbox-fillers.