<p>I would like to enable mTLS between services in one K8S namespace. I wonder if I can do it without using service mesh? I considered cert-manager but all the examples I've seen involved Ingress resource which I do not need as my services are not exposed outside of the cluster.Thanks</p>

Revital Eres
<p>Using <em>Service Mesh</em> like <a href="https://istio.io/" rel="nofollow noreferrer">Istio</a> or <a href="https://linkerd.io/" rel="nofollow noreferrer">Linkerd</a> for this is currently the only general solution for this.</p>
<p>It should be possible to do this using a library for you app as well, the library typically would need to support certificate management. <em>Service Meshes</em> typically use EnvoyProxy as a sidecar, it has implemented novel &quot;control plane&quot; APIs for management, called <a href="https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol" rel="nofollow noreferrer">xDS protocols</a> - this is something that your library typically would need to implement. In addition you need a control plane interface to manage services.</p>
<p>A drawback with doing this in a library is that it will be language-dependent. But the pro is that it will be better performant.</p>
<p>Google has recently taking this route with <a href="https://cloud.google.com/traffic-director/docs/proxyless-overview" rel="nofollow noreferrer">Traffic Director - proxyless service mesh</a></p>
