Google Professional Cloud Developer Question 127
Select 2Google Cloud PlatformYou are designing a microservices-based application deployed on Google Kubernetes Engine (GKE). The application requires secure service-to-service communication, ensuring that only specific services can communicate with each other. Which approaches should you implement?
- A
Use Kubernetes Network Policies to restrict traffic between pods based on labels.
- B
Configure Istio service mesh to enforce mutual TLS (mTLS) between services.
- C
Rely on Kubernetes namespaces alone to isolate service-to-service communication.
- D
Use a firewall rule to block all internal traffic and allow only external traffic.
- E
Leverage Google Cloud IAM roles to control pod-to-pod communication.
Show answer and explanation
Correct answers: A, B
Explanation
To secure service-to-service communication in a Kubernetes environment, it is essential to use tools like Kubernetes Network Policies to enforce traffic restrictions and Istio service mesh for advanced security features such as mutual TLS (mTLS). These approaches ensure that only authorized services can communicate with each other while maintaining encryption and authentication. Kubernetes namespaces alone are insufficient for this purpose, and relying on firewall rules or IAM roles does not address the specific needs of pod-level communication security.
- A. Correct.
Kubernetes Network Policies are used to define rules for inbound and outbound traffic between pods, based on labels and other criteria. This is an effective way to restrict communication between services.
- B. Correct.
Istio service mesh provides advanced security features like mutual TLS (mTLS) to encrypt and authenticate service-to-service communication, ensuring secure interactions.
- C. Incorrect.
Kubernetes namespaces provide logical separation of resources but do not inherently enforce network-level restrictions or secure communication between services.
- D. Incorrect.
Firewall rules control traffic at the network level (e.g., VPC), but blocking all internal traffic would break service-to-service communication and is not a practical approach for microservices.
- E. Incorrect.
Google Cloud IAM roles manage permissions for Google Cloud resources but do not provide direct pod-to-pod communication control within Kubernetes.