mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
14 lines
1.6 KiB
Plaintext
14 lines
1.6 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * service_mesh/v2x/ossm-config.adoc
|
|
|
|
:_mod-docs-content-type: CONCEPT
|
|
[id="ossm-security-mtls_{context}"]
|
|
= About mutual Transport Layer Security (mTLS)
|
|
|
|
Mutual Transport Layer Security (mTLS) is a protocol that enables two parties to authenticate each other. It is the default mode of authentication in some protocols (IKE, SSH) and optional in others (TLS). You can use mTLS without changes to the application or service code. The TLS is handled entirely by the service mesh infrastructure and between the two sidecar proxies.
|
|
|
|
By default, mTLS in {SMProductName} is enabled and set to permissive mode, where the sidecars in {SMProductShortName} accept both plain-text traffic and connections that are encrypted using mTLS. If a service in your mesh configured to use strict mTLS is communicating with a service outside the mesh, communication might break between those services because strict mTLS requires both the client and the server to be able to verify the identify of each other. Use permissive mode while you migrate your workloads to {SMProductShortName}. Then, you can enable strict mTLS across your mesh, namespace, or application.
|
|
|
|
Enabling mTLS across your mesh at the {SMProductShortName} control plane level secures all the traffic in your service mesh without rewriting your applications and workloads. You can secure namespaces in your mesh at the data plane level in the `ServiceMeshControlPlane` resource. To customize traffic encryption connections, configure namespaces at the application level with `PeerAuthentication` and `DestinationRule` resources.
|