This chapter covers:
- End-user and service-to-service authentication and authorization
- How Istio uses the SPIFFE specification for issuing identities to workloads
- How auto mTLS is implemented
- Handling service-to-service authentication and authorization within the service mesh
- Handling end-user authentication and authorization
In the previous chapters, we learned all about getting traffic securely into the cluster and we put into practice the benefits gained from adopting a service mesh, which injects high-level networking capabilities into the service proxies, enabling features such as monitoring, tracing, resiliency, and the fine-grained control on routing ingress traffic to our workloads. Another capability provided out of the box is being “secure by default”. Which improves developer productivity and massively increases security by protecting against eavesdropping, man-in-the-middle attacks, reply attacks, etc.
In this chapter, we’ll see what it means to “secure by default”, how it works, how service-to-service and end-user authentication is implemented, and the access control that we have over services in the service mesh. But before getting to the features we’ll take a refresher in security topics and investigate how the landscape shifted when comparing monolithic applications and microservice-based ones.