Question

A financial services company is deploying a microservices application across a Kubernetes cluster. Security requirements mandate that all service-to-service traffic be encrypted and that each service cryptographically prove its identity before communication is allowed, without embedding credentials in application code. Services scale up and down dynamically, so certificates must be issued and rotated automatically. Which approach best satisfies these requirements?

Accepted Answer

Deploy a service mesh that enforces mutual TLS with automatically issued and rotated short-lived workload certificates

Answer

Terminate TLS at the ingress controller and route internal traffic in cleartext across a private VLAN

Answer

Store a shared API key in a Kubernetes ConfigMap that each service reads at startup to authenticate peers

Answer

Enable IPsec tunnels between worker nodes to encrypt all pod traffic at the network layer