Google Professional Cloud Developer Question 129
Select 2Google Cloud PlatformYou are deploying a set of microservices on Google Kubernetes Engine (GKE). Each service communicates with others via HTTP requests. To ensure secure service-to-service communication, you decide to implement a zero-trust model. Which of the following steps should you take to achieve this?
- A
Use a service mesh like Istio to enforce mutual TLS (mTLS) between services.
- B
Configure Kubernetes Network Policies to restrict traffic between services to only what is necessary.
- C
Deploy all services in the same Kubernetes namespace to simplify communication.
- D
Apply role-based access control (RBAC) policies to restrict pod-to-pod communication.
- E
Enable workload identity to authenticate and authorize service-to-service communication.
Show answer and explanation
Correct answers: A, B
Explanation
To secure service-to-service communication in a Kubernetes environment, you should combine mechanisms like mutual TLS (mTLS) using a service mesh and Kubernetes Network Policies to enforce traffic restrictions. These approaches align with the principles of a zero-trust model, ensuring both encryption and least-privilege access. While other options like RBAC and workload identity are important for security in general, they do not directly secure service-to-service communication.
- A. Correct.
Using a service mesh like Istio enables mutual TLS (mTLS), which encrypts and authenticates service-to-service communication. This is a core practice in a zero-trust model.
- B. Correct.
Kubernetes Network Policies allow you to define which pods or services can communicate with each other, helping to enforce the principle of least privilege in service-to-service communication.
- C. Incorrect.
Deploying all services in the same Kubernetes namespace does not enforce security. In fact, it could increase the blast radius in case of a compromised service.
- D. Incorrect.
RBAC policies in Kubernetes are used to control access to Kubernetes resources by users and service accounts, but they do not directly manage pod-to-pod communication.
- E. Incorrect.
Workload identity is used for securely accessing Google Cloud APIs from workloads in GKE but does not directly address service-to-service communication security.