Google Professional Cloud Developer Question 143
Select 3Google Cloud PlatformYou are developing a microservices-based application on Google Kubernetes Engine (GKE) where secure communication between services is required. Your organization's security policy mandates mutual TLS (mTLS) for all internal service-to-service communication. Which of the following steps are necessary to implement mTLS in your GKE environment?
- A
Configure a Certificate Authority (CA) to issue certificates for your services.
- B
Enable Secret Management in GKE to automatically manage SSL keys and certificates.
- C
Use a service mesh like Istio to manage and enforce mTLS between services.
- D
Update your Kubernetes Ingress to enforce mTLS for all incoming external traffic.
- E
Deploy a sidecar proxy (e.g., Envoy) with each service to handle mTLS communication.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement mTLS for internal service-to-service communication in a GKE environment, you need a Certificate Authority (CA) to issue certificates, a mechanism like a service mesh (e.g., Istio) to manage and enforce mTLS, and a sidecar proxy (e.g., Envoy) deployed with each service to handle secure communication. These components work together to ensure that mTLS is properly implemented and enforced across the microservices architecture.
- A. Correct.
Correct: A Certificate Authority (CA) is required to issue and manage certificates for establishing trust between services in mTLS.
- B. Incorrect.
Incorrect: Secret Management in GKE is useful for storing sensitive information but does not automatically handle SSL keys and certificates for mTLS.
- C. Correct.
Correct: Service meshes like Istio can simplify mTLS configuration and enforcement by managing certificates and policies at the service level.
- D. Incorrect.
Incorrect: Kubernetes Ingress focuses on external traffic and does not manage internal service-to-service mTLS communication.
- E. Correct.
Correct: A sidecar proxy (e.g., Envoy) is commonly used to handle mTLS communication between services by intercepting and securing traffic.