Google Professional Cloud Developer Question 131
Select 3Google Cloud PlatformYou are deploying a microservices-based application on Google Kubernetes Engine (GKE). To ensure secure service-to-service communication between your microservices, you decide to implement a service mesh using Anthos Service Mesh. Which of the following steps are necessary to configure secure service-to-service communication with mutual TLS (mTLS)?
- A
Enable Istio sidecar auto-injection for your Kubernetes namespaces.
- B
Configure a Kubernetes Network Policy to allow traffic only from specific IP addresses.
- C
Install Anthos Service Mesh and ensure the control plane is properly configured.
- D
Update the Kubernetes Ingress resource to use a TLS certificate for incoming traffic.
- E
Define AuthorizationPolicies in Anthos Service Mesh to control access between services.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure service-to-service communication in Anthos Service Mesh, you need to enable Istio sidecar injection for pods, install and configure Anthos Service Mesh, and use AuthorizationPolicies to control access. Kubernetes Network Policies and TLS certificates for Ingress are unrelated to configuring mTLS within the service mesh.
- A. Correct.
Correct. Enabling Istio sidecar auto-injection ensures that all pods in the namespace have an Envoy proxy, which is required for service-to-service mTLS in Anthos Service Mesh.
- B. Incorrect.
Incorrect. While Kubernetes Network Policies can be used to restrict traffic at the network level, they are not used for configuring mTLS in Anthos Service Mesh.
- C. Correct.
Correct. Installing Anthos Service Mesh and configuring its control plane is essential for enabling service-to-service mTLS.
- D. Incorrect.
Incorrect. Updating the Kubernetes Ingress resource with a TLS certificate secures external traffic to the cluster but does not configure mTLS for service-to-service communication.
- E. Correct.
Correct. AuthorizationPolicies in Anthos Service Mesh allow you to define fine-grained access control rules for service-to-service communication, which complements mTLS.