Google Professional Cloud Developer Question 128
Select 2Google Cloud PlatformYou are deploying a set of microservices on Google Kubernetes Engine (GKE). These services need to communicate with each other, but you must ensure that only authorized services can communicate and that communications are encrypted. Which of the following approaches should you implement to meet these requirements?
- A
Implement a service mesh like Istio to enforce mutual TLS (mTLS) for service-to-service communication.
- B
Use Kubernetes Network Policies to restrict traffic between pods to only the required communication paths.
- C
Deploy all microservices in the same Kubernetes namespace to simplify network communication.
- D
Apply Kubernetes Role-Based Access Control (RBAC) to control access to service accounts used by the pods.
- E
Enable the default LoadBalancer service type for each microservice to manage inter-service communication.
Show answer and explanation
Correct answers: A, B
Explanation
Securing service-to-service communication requires both encryption and access control. A service mesh like Istio provides mutual TLS (mTLS) to encrypt traffic and authenticate services, while Kubernetes Network Policies enforce restrictions on allowed communication paths. These approaches together ensure secure, authorized, and encrypted communication between microservices in a Kubernetes environment.
- A. Correct.
Implementing a service mesh like Istio provides mutual TLS (mTLS), which encrypts traffic between services and ensures that only authorized services can communicate.
- B. Correct.
Kubernetes Network Policies allow you to define fine-grained rules to restrict traffic between pods, ensuring that only the necessary communication paths are allowed.
- C. Incorrect.
Deploying all microservices in the same namespace does not enhance security. It may inadvertently increase risk by reducing isolation between services.
- D. Incorrect.
Kubernetes RBAC is used to control access to Kubernetes resources, but it does not manage or enforce inter-service communication security.
- E. Incorrect.
Using the LoadBalancer service type is not appropriate for securing service-to-service communication within a Kubernetes cluster, as it exposes services externally and bypasses internal security measures.