mTLS

Cilium uses spire to enable mTLS. spire is an open-source implementation of spiffe

How mTLS in a cluster

• spire-server gets deployed in your cluster, along with a spire-agent daemonset
• When a node generates packets for a pod, an auth table is checked to see if podA is authenticated to podB. If they are not authenticated, the agent with then reach out to the spire-agent, the spire-agent will then reach out to the spire-server, and work to authenticate podA and podB. The first packet will be dropped if the pods are not authenticatd.

Enable mTLS

• Encryption must first be enabled: encryptioned.enabled=true
• authenticated must be enabled authentication.enabled=true
• enable spire installation: authentication.mutual.spire.install.enabled=true
• You must then create a cilium network policy that matches the traffic for which you want mutual TLS auth:

apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "external-lockdown"
  namespace: dev
spec:
  endpointSelector: 
    matchLabels:
      role: frontend
  ingress:
  - fromEntities:
    - "all"
  - toPorts:
    - ports:
      -port: "80"
       protocol: TCP
    authentication:
      mode: required