How does Istio mTLS work?

Question

Accepted Answer

**mTLS (mutual TLS)** — encryption and authentication of all traffic between services.

**Enabling mTLS:**
```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
```

**Modes:** DISABLE, PERMISSIVE, STRICT.

**AuthorizationPolicy:**
```yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/production/sa/frontend"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/*"]
```

**Verification:** `istioctl authn tls-check myapp.production.svc.cluster.local`

**Advantages:** Zero-trust networking without code changes, automatic certificate rotation.

DevOps: How does Istio mTLS work?