liveBook · Manning

Peer authentication

As explained in Google Anthos in Action

Peer authentication is service-to-service authentication that verifies the identity of the communicating client.

Peer authentication verifies identities when services communicate across a service mesh, helping defend against man-in-the-middle attacks and unknown service communication while supporting a zero-trust posture. section 4.3.3

Istio supports this identity model through certificate management. Its certificate authority provisions identities to mesh workloads and can use a self-signed root, an administrator-specified root, or a delegated CA signing certificate and key. section 4.3.3

Deployment choices include:

  • Use Istio’s default self-signed root and key to sign certificates for microservices. section 4.3.3
  • Configure an existing organizational root certificate or delegated CA signing certificate and key, a common enterprise arrangement. section 4.3.3

How Google Anthos in Action covers it

How deep it goes
Explains certificate authority roles and deployment choices but stops short of peer-authentication policy configuration.
Examples
Uses self-signed roots, existing organizational roots, and delegated CA signing certificates as configuration examples.
What it assumes
Assumes service-mesh communication and basic certificate concepts, while defining certificate authorities and delegated CAs.
What you can do after
Configure Istio certificate management to provision trusted identities for workloads in a service mesh.
How it connects
Connects peer authentication with certificate authorities, digital certificates, workload identity, and authorization.
Cover of Google Anthos in Action
liveBookmanning.com
Read Google Anthos in Action on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.