Observed Signal · Sep 8, 2026 · Technical Release · Source: DEV Community · Impact: 1/5 · Sentiment: Neutral
Infrastructure Market: Gap Between TLS Everywhere and Actual Transport Security
This article discusses the common misconception of 'TLS everywhere' in cloud-native architectures, where TLS is often only implemented at the edge, leaving internal traffic unencrypted. It identifies four key layers where TLS is typically absent: ingress-to-pod, pod-to-pod, application-to-database, and cluster infrastructure certificates. The author details implementation strategies to close these gaps without necessarily adopting a service mesh, including re-encryption at the ingress, using cert-manager for automated certificate management, and implementing mTLS at the application level for smaller service estates. The article provides practical configuration examples, such as NGINX ingress annotations, cert-manager Certificate resources, and Prometheus alerting rules for certificate expiry. It emphasizes the importance of automating certificate rotation and monitoring time-to-expiry to prevent outages.
Technical article on TLS best practices, relevant to infrastructure but not a major AdTech industry event.
Key Takeaways & Evidence Grounding
- TLS is often terminated only at the edge, leaving internal traffic unencrypted in many systems.
- Kubernetes does not encrypt pod-to-pod data plane traffic by default.
- Enabling TLS on a database (e.g., RDS) does not enforce its use; connection strings need to have sslmode=require or Encrypt=True.
- kubeadm cluster CA certificates expire after one year by default, with no automated renewal.
- cert-manager automates certificate issuance and renewal in Kubernetes, supporting short-lived certificates (e.g., 24 hours).
Connected Companies & Entities
1 Entity mappedTrack Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.