Skip to main content
In this tutorial, you’ll learn how to enforce mutual TLS (mTLS) between your Kubernetes workloads using Istio’s PeerAuthentication API. We’ll cover:
  • Listing Istio Custom Resource Definitions (CRDs)
  • Inspecting pods and services in the prod namespace
  • Observing traffic before and after mTLS
  • Applying DISABLE, PERMISSIVE, and STRICT mTLS modes
  • Verifying encryption with packet capture

​
Prerequisites

  • A running Kubernetes cluster with Istio installed
  • kubectl configured for your cluster
  • Kiali add-on for traffic visualization

​
1. List Istio CRDs

Istio installs several CRDs, including PeerAuthentication. To view them:
Example output:
By default, no PeerAuthentication resources are defined:

​
2. Inspect the prod Namespace

List pods and services running in prod:
Pods:
Services:

​
3. Observe Traffic

Generate continuous requests to the devsecops-svc service:

​
4. Visualize in Kiali

Open Kiali’s Graph view for the prod namespace. By default, Istio uses PERMISSIVE mTLS, so you’ll see both plaintext and encrypted traffic between devsecops-svc and node-service.
The image shows a Kiali dashboard displaying a service mesh graph for a Kubernetes environment, illustrating the connections and response times between different services.
Click the lock icon to confirm which connections are encrypted.

​
5. Disable mTLS Globally

Disabling mTLS will route all service-to-service traffic over plaintext HTTP, exposing your data in transit.
Create a PeerAuthentication in the istio-system namespace:
Apply it:
Wait ~15 seconds and refresh Kiali. You’ll first see mixed traffic, then all connections drop the lock icon.

​
6. Switch to Permissive Mode

Permissive mode allows both mTLS and plaintext connections simultaneously—ideal for gradual rollout.
Edit the default PeerAuthentication:
Update the spec:
Save and exit, then verify:
Refresh Kiali to observe a mix of encrypted and unencrypted traffic.

​
7. Enforce Strict mTLS Mode

To require mTLS for all workloads:
Change to:
Save. The curl loop will now fail, as plaintext requests are blocked. Kiali will show a fully locked mesh:
The image shows a Kiali dashboard displaying a service mesh graph for a Kubernetes environment, illustrating the connections and response times between different services.
Hover over the lock icon to see “Mesh-wide mTLS is enabled.”

​
8. Verify with Packet Capture

Install the ksniff plugin and capture traffic to confirm encryption:
Open the resulting PCAP in Wireshark and inspect TLS records on port 15001.
In this lesson, you learned how to manage mTLS modes with Istio’s PeerAuthentication API and verify traffic encryption. Next, explore securing ingress traffic using the Istio ingress gateway.

Watch Video