Question

A security team requires that all traffic between microservices inside the cluster be encrypted in transit and that each service authenticate the other before exchanging data. The developers do not want to modify application code to add TLS logic. Which approach best satisfies this requirement?

Accepted Answer

Deploy a service mesh that injects sidecar proxies to provide mutual TLS (mTLS) between services

Answer

Apply a default-deny NetworkPolicy to every namespace to block unencrypted traffic

Answer

Switch all Services from ClusterIP to LoadBalancer so the cloud provider terminates TLS

Answer

Store TLS certificates in a Secret and mount them into each Pod as a volume