<p>I am adding security to my cluster. One of the requirements is that the communication between pods is secure.</p>
<p>The most viable option I found is to implement a &quot;service mesh&quot;. I have seen that Calico, Istio, Linkerd are good options. But I don't know which one is the lightest as any of them have a lot of components that I won't really need.</p>
<p>If you have another recommendation, it is welcome.</p>
<p>I read:</p>
<ul>
<li><a href="https://stackoverflow.com/questions/62881298/what-is-pod-to-pod-encryption-in-kubernetes-and-how-to-implement-pod-to-pod-enc">What is pod to pod encryption in kubernetes? And How to implement pod to pod encryption by using mTLS in kubernetes?</a></li>
<li><a href="https://stackoverflow.com/questions/45453187/how-to-configure-kubernetes-to-encrypt-the-traffic-between-nodes-and-pods">How to configure Kubernetes to encrypt the traffic between nodes, and pods?</a></li>
<li><a href="https://medium.com/@santhoz/nginx-sidecar-reverse-proxy-for-performance-http-to-https-redirection-in-kubernetes-dd9dbe2fd0c7" rel="nofollow noreferrer">https://medium.com/@santhoz/nginx-sidecar-reverse-proxy-for-performance-http-to-https-redirection-in-kubernetes-dd9dbe2fd0c7</a></li>
</ul>

<p>Calico is an overlay network and CNI implementation. It won't automatically encrypt the communication between pods on its own, as far as I know.</p>
<p>Linkerd and Istio are service meshes which implement CNI to encrypt traffic with a CNI provider like calico, <em>but</em> a CNI provider is not required.</p>
<p>Linkerd will <a href="https://linkerd.io/2/features/automatic-mtls/" rel="nofollow noreferrer">automatically</a> encrypt traffic with mTLS out of the box.</p>
<p>I think Istio added that feature recently.</p>
<p>Linkerd is much easier to install and use, and its proxy is <a href="https://kinvolk.io/blog/2019/05/performance-benchmark-analysis-of-istio-and-linkerd/" rel="nofollow noreferrer">faster and uses fewer resources</a>.</p>
