What is gRPC-ALTS (Application Layer Transport Security)?

ALTS (Application Layer Transport Security) is Google's internal authentication and encryption protocol, designed as an alternative to TLS for Google Cloud environments. Unlike TLS which operates at the transport layer, ALTS is implemented at the application layer and is tightly integrated with Google's infrastructure for machine identity. Key features: (1) Mutual authentication — both client and server authenticate using workload identity (tied to service accounts); (2) No certificate management — identity is established through the Google Cloud metadata service, eliminating the certificate lifecycle management burden of mTLS; (3) Hardware acceleration — ALTS is optimized for Google's data centers and can leverage hardware encryption offloading; (4) Transparent rekeying — session keys are rotated during long-lived connections; (5) Usage — set up with credentials.NewClientALTSCredentials() in gRPC Go. ALTS is only available within Google Cloud infrastructure; external deployments use TLS/mTLS instead.