Securing a service mesh
In this section, we will learn how to use Istio to improve the security of a service mesh. We will cover the following topics:
- How to protect external endpoints with HTTPS and certificates
- How to require that external requests are authenticated using OAuth 2.0/OIDC access tokens
- How to protect internal communication using mutual authentication (mTLS)
Let’s now understand each of these in the following sections.
Protecting external endpoints with HTTPS and certificates
From the Setting up access to Istio services and Content in the _istio_base.yaml template sections, we learned that the gateway objects use a TLS certificate stored in a Secret named hands-on-certificate for its HTTPS endpoints.
The Secret is created by the cert-manager based on the configuration in the istio-system Helm chart. The chart’s template, selfsigned-issuer.yaml, is used to define an internal self-signed CA and has the following...
