The Switch Nobody Wants to Flip First
“mTLS is enabled”, says the team. When asked, it turns out the mesh default has been on PERMISSIVE since the rollout. That is not enabled. That is a maybe.
- Date
- Topic
- mTLS
- Sources
- 3
- Reading time
- 2 min
- Version
- Translation
PERMISSIVE means: the sidecar accepts mTLS, but also plaintext. As a migration state, that is exactly right, nobody wants to tear down half the landscape during the rollout. As a permanent state, it means encryption “most of the time”. Nobody knows how much plaintext is still in transit. Report #1 sends its regards: secure by gut feeling.
Figure as text
Staged path from PERMISSIVE to STRICT: the starting state allows mTLS and plaintext in parallel, the plaintext share is unknown, then STRICT is enforced first per namespace and finally mesh-wide. Before each stage sits a measurement gate built on istio_requests_total with the connection_security_policy label, below it the rollback path back to PERMISSIVE as a single apply.
The path to STRICT is not a leap of faith but a measurement.
Observe first: istio_requests_total carries the connection_security_policy label. One query, and you see which connections are still running without mutual_tls. The same telemetry as in report #9, this time as a migration radar.
Then tighten in stages: PeerAuthentication with mode: STRICT, first per workload or namespace, wherever the metric shows zero plaintext. If a legacy client is still hanging on after all, it surfaces individually instead of in one big bang. The mesh-wide switch comes last, once the remaining list is empty. And the rollback path is named before anyone flips a switch: the PeerAuthentication back to PERMISSIVE, one apply, no redeploy.
For decision makers, the difference is bigger than it sounds. “Encryption is configured” is a statement of intent. “Plaintext is technically impossible, here is the metric” is proof. An auditor asks for exactly the second sentence.
Anyone who stops at PERMISSIVE has never unpacked the moving boxes and calls the apartment furnished.
Even so, one issue remains open after that: mTLS cleanly answers WHO is talking. It does not say a word about who is ALLOWED to talk. More on that next week.
