kubernetes Pods 之间的 TLS 通信（更轻量级的解决方案）

Question

I am adding security to my cluster. One of the requirements is that the communication between pods is secure.

The most viable option I found is to implement a "service mesh". I have seen that Calico, Istio, Linkerd are good options. But I don't know which one is the lightest as any of them have a lot of components that I won't really need.

If you have another recommendation, it is welcome.

I read:

• What is pod to pod encryption in kubernetes? And How to implement pod to pod encryption by using mTLS in kubernetes?
• How to configure Kubernetes to encrypt the traffic between nodes, and pods?
• https://medium.com/@santhoz/nginx-sidecar-reverse-proxy-for-performance-http-to-https-redirection-in-kubernetes-dd9dbe2fd0c7

Answer 1

Calico is an overlay network and CNI implementation. It won't automatically encrypt the communication between pods on its own, as far as I know.

Linkerd and Istio are service meshes which implement CNI to encrypt traffic with a CNI provider like calico, but a CNI provider is not required.

Linkerd will automatically encrypt traffic with mTLS out of the box.

I think Istio added that feature recently.

Linkerd is much easier to install and use, and its proxy is faster and uses fewer resources .