Google Professional Cloud Developer Question 130
Select 2Google Cloud PlatformYou are deploying a microservices application on Google Kubernetes Engine (GKE). Your team requires secure service-to-service communication between the microservices. You want to enforce access control policies and encrypt traffic between services. Which of the following approaches should you take?
- A
Use a service mesh like Istio to enforce mTLS (mutual Transport Layer Security) between services and define access control policies.
- B
Configure Kubernetes Network Policies to restrict communication between pods based on labels and namespaces.
- C
Use Kubernetes RBAC (Role-Based Access Control) to restrict pod-to-pod communication.
- D
Enable Workload Identity to authenticate service accounts and encrypt traffic between services.
- E
Create separate Kubernetes namespaces for each service and rely on namespace isolation for secure communication.
Show answer and explanation
Correct answers: A, B
Explanation
To secure service-to-service communications, you need to ensure both encryption and access controls. A service mesh like Istio provides mTLS for encryption and fine-grained access control policies. Additionally, Kubernetes Network Policies allow you to enforce network-level restrictions between pods based on labels and namespaces, complementing the security provided by a service mesh. Other options like RBAC, Workload Identity, and namespace isolation are not directly applicable to service-to-service communication security.
- A. Correct.
This is correct. A service mesh like Istio provides mTLS to encrypt service-to-service communication and allows you to define fine-grained access control policies, ensuring security.
- B. Correct.
This is correct. Kubernetes Network Policies provide a way to control communication between pods at the network level, allowing you to restrict access based on labels and namespaces.
- C. Incorrect.
This is incorrect. Kubernetes RBAC is used for controlling access to the Kubernetes API, not for securing pod-to-pod communication.
- D. Incorrect.
This is incorrect. Workload Identity is used for assigning Google Cloud IAM roles to Kubernetes service accounts, not for encrypting traffic or restricting service-to-service communication.
- E. Incorrect.
This is incorrect. While namespaces offer basic isolation, they are not sufficient on their own to secure service-to-service communications comprehensively.