Help Center/ Ubiquitous Cloud Native Service/ User Guide/ Service Mesh/ Service Security/ Peer Authentication
Updated on 2025-07-30 GMT+08:00
View PDF
Share

Peer Authentication

ASM enables communication between service instances using a Policy Enforcement Point (PEP) tunnel. Peer authentication defines how traffic will be tunneled (or not) to a service instance. By default, service instances that have sidecars injected communicate with each other through the PEP tunnel. Traffic is automatically encrypted using TLS. Peer authentication controls the mode of two-way authentication on the target workload.

Creating a Peer Authentication Policy

Create a peer authentication policy using YAML.

  1. Log in to the UCS console. In the navigation pane, choose Service Meshes. Click the name of the target service mesh to go to its details page.
  2. In the navigation pane, choose Service Security > Peer Authentication.
  3. Click Create from YAML in the upper right corner.
  4. Enable two-way authentication for the service. The service will allow access from the invoker and only process requests encrypted using TLS. 

    apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication       # Set the service security type to peer authentication.
metadata:
  name: peer-policy            # Name the peer authentication policy.
  namespace: weather           # Set the namespace to weather.
spec:
  selector:
    matchLabels:
      app: forecast            # Add a label key-value pair.
  mtls:
    mode: STRICT

    To complete the unified authentication policy, configure the parameters as follows:

    apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: mesh_tls
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

Updating a Peer Authentication Policy

  1. Log in to the UCS console. In the navigation pane, choose Service Meshes.
  2. Click the name of the target service mesh to go to its details page.
  3. In the navigation pane, choose Service Security > Peer Authentication.
  4. Locate the authentication policy to be updated and click Edit YAML in the Operation column.
  5. Update the peer authentication policy based on the site requirements. For example, to update the unified authentication policy to the unified namespace authentication policy, configure the parameters as follows: 

    apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ns_weather_tls
  namespace: weather
spec:
  mtls:
    mode: STRICT

Deleting a Peer Authentication Policy

Deleted peer authentication policies cannot be recovered. Deleting a peer authentication policy will not affect the running of associated services.

  1. Log in to the UCS console. In the navigation pane, choose Service Meshes.
  2. Click the name of the target service mesh to go to its details page.
  3. In the navigation pane, choose Service Security > Peer Authentication.
  4. Locate the authorization policy to be deleted and click Delete in the Operation column.
  5. In the dialog box displayed, click Yes.

Case

Update the unified authentication policy to the unified namespace authentication policy.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ns_weather_tls
  namespace: weather
spec:
  mtls:
    mode: STRICT
Parent topic: Service Security