What does mTLS add beyond Cilium security identities and network encryption?

For a homelab, you probably do not need mTLS unless you want to learn it or have a specific requirement. If someone can inspect traffic directly on a node, the cluster already has a serious compromise, so pod-level encryption may not change the outcome in that scenario. The strongest case is defense in depth: internal traffic should not automatically be trusted just because it came from inside the cluster. This became important for large systems because protecting the perimeter was not enough; internal services also needed authentication and encryption.

There is some overlap. Cilium can provide strong workload identities and network policies, and for many environments that may be sufficient. A service mesh adds portable application-layer identity and encryption, often independently of the particular CNI. It can also provide features such as traffic routing, retries, telemetry, circuit breaking, and canary or blue-green deployments. In that situation, mTLS is one part of the mesh rather than the only reason to install it.

WireGuard protects traffic between nodes, but it does not necessarily establish which individual workload is allowed to make a particular application request. If traffic is injected or forwarded from somewhere inside a trusted node or network, node-level encryption alone does not provide much workload-level trust. mTLS adds defense in depth by allowing the receiving service to verify the calling workload’s certificate, including in multi-cluster setups where network location may not be enough.

mTLS authenticates both sides of an application connection and encrypts that connection. Regular TLS usually proves the server’s identity to the client; mutual TLS also gives the server a verified identity for the client. That makes it useful for workload-to-workload authentication at the application layer. Authorization is not automatic, though—you still need to validate the certificate identity and map it to permissions or policies. Cilium identities and network policies operate mostly at the network and transport layers, while mTLS protects and identifies the actual application connection.