10.2. Network Policies and mTLS
By default, every pod in a cluster can talk to every other pod — a flat network that turns one compromised service into cluster-wide access. Closing that gap means two things: network policies that act as a pod-level firewall, and mTLS that makes every service prove its identity cryptographically on every call. This chapter covers both, the certificate lifecycle (issuance, rotation, and the expiry that causes classic mesh outages) that makes mTLS operable, and the eBPF and Gateway API developments reshaping how it is enforced.
Topics Covered
Section titled “Topics Covered”- 10.2.1. Kubernetes Network Policy: Pod-Level Firewall: Covers Kubernetes Network Policies that act as a pod-level firewall over the default-flat cluster network.
- 10.2.2. mTLS: Mutual Authentication and Encryption: Explains mutual TLS, making every service prove its identity cryptographically on every call.
- 10.2.3. Certificate Lifecycle: Cert-Manager, SPIFFE / SPIRE: Covers certificate issuance and rotation with cert-manager and SPIFFE/SPIRE, and the expiry that causes outages.
- 10.2.4. eBPF Networking: Kernel-Level CNI with Cilium: Explains Cilium’s eBPF-based CNI that enforces networking and policy at the kernel level.
- 10.2.5. Ingress vs. Gateway API: Next-Generation Traffic Management: Compares the legacy Ingress with the role-oriented Gateway API for next-generation traffic management.