Detailed text description: Confidential service mesh

This page provides a long description of the service mesh diagram used in the Confidential architecture article. It shows how traffic between two confidential services is encrypted.

Overview​

Background colors mark trust. Green areas are trusted. Red areas with a dashed border are untrusted. Two green confidential micro-VMs sit inside a red area labeled untrusted infrastructure. The red area stands for the network between the micro-VMs.

Main components​

1. First confidential micro-VM:

• Contains service A and its proxy.
• Service A talks only to its local proxy.

2. Second confidential micro-VM:

• Contains service B and its proxy.
• Service B talks only to its local proxy.

Traffic flow​

1. Service A sends traffic to its proxy.
2. The proxy encrypts the traffic with mutual TLS (mTLS) and sends it across the untrusted network.
3. The proxy of service B decrypts the traffic and passes it on to service B.