Smart endpoints,
dumb pipes.

01The three-layer lock

A request crosses three checkpoints. The gateway and mesh do fast, generic checks (coarse-grained); only your app can answer “is this row yours?” (fine-grained). Tap a stop to see its job — and what the wire carries.

02The clean boundary — what goes in the pipe

To avoid redundancy, push crypto + identity into the pipe so the app never re-checks them. The trap is pushing everything in: the pipe can’t see your database, so it can’t answer ownership — and the app becomes a confused deputy. Flip the toggle.

03Header trust vs the double lock

Trust the injected header (fast, tiny app code) or re-parse the token everywhere (paranoid, heavy)? You don’t have to choose — mTLS plus localhost binding gives Zero Trust isolation with zero app crypto.

04The one trap: “Blind Trust”

Once the app blindly trusts X-User-Id, anyone who reaches its port can forge it. The fix is to make sure nobody can bypass the mesh to talk to the app directly. Turn mTLS off, then run the attack.

05How mTLS works — the handshake

The mesh is a Certificate Authority. Two peers swap certificates, then pass two checks: ownership (a challenge-response) and authority (a CA signature). Both must pass — which is why a man-in-the-middle can’t fake it.

06The chain of trust — issued, then checked

The whole story in one picture, because the two halves only make sense together. Phase ①: a pod is born, is handed ca.crt, mints its own key pair, sends a CSR, and gets back a certificate — its public key plus a signature made with the mesh private key. Phase ②: two pods swap those certificates and each checks the signature inside the other’s using the ca.crt it already had. Step through both.

The same five issuance beats, with the file each one produces:

07The file zoo — .key · .csr · .crt · .pub

Four look-alike files, four different jobs. One is a secret you guard with your life; the rest are safe to hand out. Tap a card.

08Anatomy of a certificate

A certificate is a passport: identity fields (CN, O, OU, C), the public key, and the CA’s signature over all of it. Tap a field.

09Why pod-level, not service-level

A Kubernetes Service is a routing rule — a ghost with no CPU or memory to hold a key. And a shared key means one breached pod compromises them all. TLS is point-to-point, so the certificate lives in the pod.

why not shareOne key per Service means every pod shares one private key — breach one, spoof all. Per-pod keys contain the blast radius.

10Does it scale? 10 pods or 10,000

Pods never store each other’s certificates — each holds only ca.crt and verifies peers with local math. Per-pod memory stays flat; only the CA’s work grows. Drag the slider.

11Kong instead of a mesh

No mesh? The gateway can be the CA. Same cryptographic guarantee, simpler ops — a static shared cert instead of per-pod rotation. Often the right call for medium systems.

// Node.js app enforcing mTLS with Kong — no mesh required
const https = require('https')
const fs = require('fs')

https.createServer({
  key:  fs.readFileSync('/etc/tls/pod.key'),   // the pod's own key
  cert: fs.readFileSync('/etc/tls/pod.crt'),   // + its cert
  ca:   fs.readFileSync('/etc/tls/ca.crt'),    // the CA's cert (holds its public key)

  requestCert: true,        // demand Kong's client certificate
  rejectUnauthorized: true, // drop anyone the ca.crt can't vouch for
}, (req, res) => {
  // Reached here ⇒ traffic is cryptographically proven to be Kong.
  const userId = req.headers['x-user-id']   // now safe to trust
  res.end(`Hello ${userId}`)
}).listen(8443)

12Try it — OpenSSL in five commands

The mesh’s magic is just standard cryptography. Here’s the whole chain of trust — CA key, CA cert, pod key + CSR, sign, verify — with the exact commands. Step through them.

$ openssl genrsa -out ca.key 4096

$ openssl req -x509 -new -key ca.key \
  -subj "/O=Pangaea/CN=Mesh-Root-CA" -out ca.crt

$ openssl genrsa -out pod.key 2048
openssl req -new -key pod.key \
  -subj "/O=Pangaea/OU=Platform/CN=order-service.internal" \
  -out pod.csr

$ openssl x509 -req -in pod.csr \
  -CA ca.crt -CAkey ca.key -days 1 -out pod.crt

Signature ok
subject=/O=Pangaea/OU=Platform/CN=order-service.internal
→ pod.crt  (the signed passport)

13HTTPS is mTLS with one lock

The padlock in your browser is the same handshake — minus one direction. The server proves itself via public root CAs; you prove yourself with a login. Flip the mode.