Methods for horizontal authentication between microservices (RESTful)

5/16/2019

Looking for a simpler approach for authentication between microservices in Kubernetes.

I have dug some previous discussion. I am aware that it has many trade-offs. Depend on the situation, there could be many different approaches.

Mutual TLS is probably very safe. There is a tool Istio. But I think it has a learning curve and probably overkill for my application.

My application is simple. It does not contain any privacy or critical data. I would prefer a much simpler approach to meet the tight deadline of release cycle.

Is there any approach that utilize Kubernetes secret and do not need a SSL handshake?

For example, keep a pair of asymmetric key in kubernetes secret. Then when service A what to access service B. service A sign the request with timestamp, send the signed result to service B. So that service B could decrypt and check?

-- Maxi Wu
authentication
kubernetes
microservices

0 Answers