TLS

As explained in Google Anthos in Action

Transport Layer Security is a cryptographic protocol that protects network communications with confidentiality, integrity, and endpoint authentication.

Transport Layer Security (TLS) protects communication between senders and receivers through privacy, authenticity, and data integrity. It uses symmetric encryption with a shared secret, public-key signatures, and message-integrity checks. section 5.1.1

In cloud and service-mesh deployments, TLS supports several operational responsibilities:

• Istio uses X.509 certificates to give workloads strong identities and support service-to-service authentication. section 4.3.3
• Mutual TLS encrypts service communication and authenticates peers without requiring application-code changes. section 4.3.3
• Istio agents and the Istio CA automate certificate issuance, distribution, key management, and rotation at scale. section 4.3.3
• Enterprise deployments can use an existing root or delegated CA signing certificate instead of Istio’s self-signed root. section 4.3.3

Connect Agent outbound channel

A Connect Agent can maintain a persistent TLS 1.2 connection from a Kubernetes cluster to Google Cloud. The outbound, encrypted tunnel lets Google Cloud console issue commands without exposing an inbound firewall rule or requiring a VPN; the cluster needs egress to Google Cloud APIs. section 5.1.1

Figure 5.3 The outbound connection to Google Cloud from Anthos deployments

Trace the outbound encrypted connection from an Anthos deployment to Google Cloud. section 5.1.1

How Google Anthos in Action covers it

How deep it goes

Explains encryption, signatures, integrity checks, certificates, mutual authentication, and automated rotation.

Examples

Uses Istio workload certificates and a Connect Agent’s persistent outbound TLS 1.2 tunnel as deployment examples.

What you can do after

Operate/configure encrypted service and cloud-management channels while selecting certificate-authority and network-exposure arrangements.

How it connects

Connects X.509 certificates, HTTPS, mutual TLS, certificate authorities, Istio, Kubernetes, and Google Cloud.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Real-World CryptographyTLS is the Transport Layer Security protocol for securing network communications through authentication, confidentiality, and integrity.
• 

  liveBookmanning.com
  Software Security for DevelopersTLS is a cryptographic protocol standard that provides confidentiality, integrity, and authenticated communication over networks.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eTransport Layer Security is a cryptographic protocol that provides authenticated and encrypted communication over a network.
• 

  liveBookmanning.com
  Logs and TelemetryTransport Layer Security is a cryptographic protocol that authenticates endpoints and protects network communications against interception and tampering.
• 

  liveBookmanning.com
  Kafka for ArchitectsTLS is a cryptographic protocol that authenticates endpoints and protects data in transit through encryption and integrity checks.
• 

  liveBookmanning.com
  gRPC Microservices in GoSSL/TLS is a family of cryptographic communication protocols that authenticates peers and encrypts data exchanged over a network.
• 

  liveBookmanning.com
  Authorization in ActionTransport Layer Security is a cryptographic protocol that provides secure communication over a network, including encryption and peer authentication.
• 

  liveBookmanning.com
  Hacking CryptographyTLS is a cryptographic protocol for securing communications over computer networks.
• 

  liveBookmanning.com
  MongoDB 8.0 in Action, Third EditionTLS is a cryptographic network protocol that provides encrypted communication and server or client authentication over a network connection.
• 

  liveBookmanning.com
  Learn Docker in a Month of Lunches, Second EditionTLS is a cryptographic protocol that provides encrypted and authenticated communication over a network.
• 

  liveBookmanning.com
  Data-Driven CybersecurityTLS is a cryptographic protocol that provides secure communication over a network by protecting data confidentiality and integrity and authenticating endpoints.
• 

  liveBookmanning.com
  Kubernetes for DevelopersTLS is a cryptographic protocol that encrypts network communication and can authenticate endpoints using certificates.
• 

  liveBookmanning.com
  Grokking Web Application SecurityTLS is a cryptographic protocol that provides confidentiality, integrity, and authentication for network communications.
• 

  liveBookmanning.com
  Apache Kafka in ActionTransport Layer Security (TLS) is a cryptographic protocol that provides authenticated, encrypted communication and protects network traffic from eavesdropping and tampering.

Compare how 15 books explain TLS →

Related concepts

• HTTPSused by · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.
• public key cryptographyuses · Public-key cryptography is asymmetric cryptography that uses mathematically related public and private keys for encryption, decryption, signing, and verification.
• cipher suiteuses · A cipher suite is a defined or negotiated combination of cryptographic algorithms and parameters used to secure a communication session.
• heartbeat extensionhas part · The TLS heartbeat extension is a protocol extension that lets a peer request an arbitrary payload to be echoed for connection liveness checking.
• TCPuses · TCP is a connection-oriented transport-layer protocol that provides reliable, ordered delivery of byte streams between network endpoints.
• symmetric key encryptionuses · Symmetric-key encryption is cryptography that uses the same shared secret key, or equivalent derived key material, to encrypt and decrypt data.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.