Abstract: Information is provided to a service mesh by a Kubernetes (K8s) controller. The information enables the service mesh to determine an IP address of application pods to which a monitoring request is destined. The K8s controller detects which of the application pods are scheduled to be monitored by the monitoring service. The K8s controller creates dummy headless services that match the application pods scheduled to be monitored. The service mesh is programmed information from the dummy headless services to cause the service mesh to intercept the monitoring request and identify that the monitoring request is destined to the dummy headless service based on the addresses. In response the service mesh encrypts the monitoring request.

Abstract: A computer-implemented method, data processing system and computer-readable medium for a pod of a container orchestration platform to secure metrics relating to the pod prior to transmission of metrics to a metrics collection service. The method comprising: receiving a secure request at a pod IP address and forwarding the request to a container of the pod; and receiving an insecure request at the pod IP address; examining the content of the received insecure request; from the examining, determining whether the received insecure request is requesting metrics information; if it was determined that the received insecure request does not request metrics information, passing the request to an original destination within the pod, and if it was determined that the received insecure request does request metrics information, rejecting the received insecure request.

Abstract: A method of processing traffic to provide a service is described. A first service mesh in a first cluster is used to ensure traffic is communicated within the first cluster using a secure communications protocol with mutual authentication accomplished using a certificate chain having a root certificate. A client in the first cluster originates traffic to a second cluster for processing, the second cluster having access to the root certificate. Using the first service mesh, routing the traffic to the second cluster is done using a secure communications protocol with mutual authentication. Mutual authentication is carried out between the first cluster and the second cluster using certificate chains having the root certificate; and in response to the mutual authentication being successful, application data is routed to the second cluster using the secure communications protocol such that the application data may be processed at the second cluster to provide the service.