<commit_before>// Module included in the following assemblies:
//
// * service_mesh/service_mesh_user_guide/ossm-security.adoc

[id="ossm-security-mtls_{context}"]
= Enabling mutual Transport Layer Security (mTLS)

Mutual Transport Layer Security (mTLS) is a protocol where two parties authenticate each other at the same time. It is the default mode of authentication in some protocols (IKE, SSH) and optional in others (TLS).

MTLS can be used without changes to the application or service code. The TLS is handled entirely by the service mesh infrastructure and between the two sidecar proxies.

By default, {ProductName} is set to permissive mode, where the sidecars in {ProductShortName} accept both plain-text traffic and connections that are encrypted using mTLS. If a service in your mesh is communicating with a service outside the mesh, strict mTLS could break communication between those services. Use permissive mode while you migrate your workloads to {ProductShortName}.

== Enabling strict mTLS across the mesh

If your workloads do not communicate with services outside your mesh and communication will not be interrupted by only accepting encrypted connections, you can enable mTLS across your mesh quickly. Set `spec.istio.global.mtls.enabled` to `true` in your `ServiceMeshControlPlane` resource. The operator creates the required resources.

[source,yaml]
----
apiVersion: maistra.io/v1
kind: ServiceMeshControlPlane
spec:
  istio:
    global:
      mtls:
        enabled: true
----

[id="ossm-security-mtls-sidecars-incoming-services_{context}"]
=== Configuring sidecars for incoming connections for specific services

You can also configure mTLS for individual services or namespaces by creating a policy.

[source,yaml]
----
apiVersion: "authentication.maistra.io/v1"
kind: "Policy"
metadata:
  name: "default"
  namespace: <NAMESPACE>
spec:
  peers:
  - mtls: {}
----

[id="ossm-security-mtls-sidecars-outgoing_{context}"]
== Configuring sidecars for outgoing connections

Create a destination rule to configure {ProductShortName} to use mTLS when sending requests to other services in the mesh.

[source,yaml]
----
apiVersion: "networking.istio.io/v1alpha3"<commit_msg>Correct apiVersion of the "Policy"<commit_after>// Module included in the following assemblies:
//
// * service_mesh/service_mesh_user_guide/ossm-security.adoc

[id="ossm-security-mtls_{context}"]
= Enabling mutual Transport Layer Security (mTLS)

Mutual Transport Layer Security (mTLS) is a protocol where two parties authenticate each other at the same time. It is the default mode of authentication in some protocols (IKE, SSH) and optional in others (TLS).

MTLS can be used without changes to the application or service code. The TLS is handled entirely by the service mesh infrastructure and between the two sidecar proxies.

By default, {ProductName} is set to permissive mode, where the sidecars in {ProductShortName} accept both plain-text traffic and connections that are encrypted using mTLS. If a service in your mesh is communicating with a service outside the mesh, strict mTLS could break communication between those services. Use permissive mode while you migrate your workloads to {ProductShortName}.

== Enabling strict mTLS across the mesh

If your workloads do not communicate with services outside your mesh and communication will not be interrupted by only accepting encrypted connections, you can enable mTLS across your mesh quickly. Set `spec.istio.global.mtls.enabled` to `true` in your `ServiceMeshControlPlane` resource. The operator creates the required resources.

[source,yaml]
----
apiVersion: maistra.io/v1
kind: ServiceMeshControlPlane
spec:
  istio:
    global:
      mtls:
        enabled: true
----

[id="ossm-security-mtls-sidecars-incoming-services_{context}"]
=== Configuring sidecars for incoming connections for specific services

You can also configure mTLS for individual services or namespaces by creating a policy.

[source,yaml]
----
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "default"
  namespace: <NAMESPACE>
spec:
  peers:
  - mtls: {}
----

[id="ossm-security-mtls-sidecars-outgoing_{context}"]
== Configuring sidecars for outgoing connections

Create a destination rule to configure {ProductShortName} to use mTLS when sending requests to other services in the mesh.

[source,yaml]
----
apiVersion: "networking.istio.io/v1alpha3"
{'fraction_non_alphanumeric': 0.07523226829820984, 'fraction_numerical': 0.0020394289598912306, 'mean_word_length': 4.769934640522876, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7035353', 'n_tokens_mistral': 1206, 'n_tokens_neox': 1162, 'n_words': 521}