A deep-dive into running Vault's PKI secrets engine in production: two-tier CA hierarchy, auto-rotating certificates, cert-manager integration, SPIFFE SVIDs, the revocation story, and operational hardening.
Mtls
-
Vault PKI Secrets Engine in Production: Intermediate CAs, cert-manager, and Short-Lived Certificates as a Security Primitive -
Consul Service Discovery and Service Mesh How HashiCorp Consul turns service discovery from static config into dynamic, health-aware runtime queries — its DNS and HTTP interfaces, health checking, and KV store — then grows into a full service mesh with mTLS between services.
-
mTLS Everything: Certificate-Based Service Identity with SPIFFE, SPIRE, and Envoy A comprehensive guide to mutual TLS—covering certificate-based service identity, SPIFFE/SPIRE workload attestation, mTLS with Envoy sidecars, Istio's control plane, and building a zero-trust service mesh from the ground up.
-
Service Meshes with Istio and Linkerd A practical guide to service meshes — what they are, when you actually need one, and how to use Istio and Linkerd for mTLS, traffic splitting, observability, and fault injection.