Recall the difference between mTLS mode, authentication, and authorization policy.
Authentication What does STRICT mTLS require? The workload accepts only mutual TLS traffic from meshed peers. It proves peer identity on the connection; it does not by itself define allowed business operations. Migration What is PERMISSIVE mode for? A migration window where mTLS and plaintext can coexist while callers are discovered and fixed. Use it as an evidence bridge, not as a permanent exception. Compare PeerAuthentication versus AuthorizationPolicy Use both for zero-trust service access: authenticate the caller, then authorize the action. Review trap We set STRICT, so refunds-api is locked down. A teammate treats mTLS as an allow list. Your…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in