CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

Service Mesh Security Capabilities

KCSA asks what a service mesh provides. The honest way to answer is to measure what is missing without one: this guide proves pod-to-pod traffic is in clear by reading it off the node, then shows the identity and HTTP-level policy this CNI already provides without a single sidecar.

Platform Security Guide 37 of 42 Advanced

This cluster is Cilium 1.18.1 with Encryption: Disabled and Envoy running as one DaemonSet Pod per node. A sidecar mesh runs one proxy per Pod instead; the capabilities overlap and the deployment model does not.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when you have to say what a service mesh actually buys you. This matters because KCSA asks about mesh capabilities, and the honest answer starts by measuring what your cluster does without one - including whether traffic between nodes is encrypted at all.

Before you start

  1. Is there a mesh here at all

  2. Proving what unencrypted means

  3. The identity policy is actually written against

  4. Layer 7 policy, with no sidecar anywhere

Official sources

← All KCSA guides