Zero Trust Architecture in Kubernetes

Chapter 7. Encrypt All Access

One of the main objectives in the cybersecurity field is for applications and networks to encrypt as much data as possible, both in storage and in transit. End-to-end encryption ought to be the standard for data in transit through networks. Thorough encryption helps protect the confidentiality and integrity components of the CIA triad of cybersecurity. As nothing should be trusted by default, regardless of its origin, establishing end-to-end encryption in all directions is essential for zero trust security.

Ultimately, all access in your Kubernetes-based cloud network must be encrypted. Here’s how we can make sure all network encryption is automated effectively.

East-West Traffic

The service mesh can be set up to offload encryption and identity management work within your internal network from your Kubernetes clusters and their applications. Mutual TLS (mTLS) is the encryption protocol that can be used for that purpose, ensuring that all the data traveling within your internal network is ciphertext.

Configure mTLS in your service mesh with the “Strict” setting. “Off” disables mTLS between your Pods, and communication from all sources would be sent as cleartext. Unless you’re testing something in a development environment, that’s a terrible idea. The default setting in many Kubernetes-compatible service meshes is “Permissive,” which enables mTLS between Pods but also permits cleartext traffic where mTLS cannot be established. Avoid that if at all ...