Google Professional Cloud Network Engineer Question 310
Select 3Google Cloud PlatformYour organization is migrating a microservices-based application to Google Cloud and plans to use Cloud Service Mesh to manage service-to-service communication. You are tasked with configuring Cloud Service Mesh to enforce mutual TLS (mTLS) between services. Which of the following steps are required to achieve this?
- A
Enable the Mesh CA for automatic certificate management.
- B
Configure an HTTP Load Balancer to handle external traffic.
- C
Annotate the Kubernetes namespaces with the 'istio-injection=enabled' label.
- D
Define a PeerAuthentication policy to enforce mTLS.
- E
Configure firewall rules to allow TCP traffic on port 80.
Show answer and explanation
Correct answers: A, C, D
Explanation
To enable mTLS in Cloud Service Mesh, you must configure the mesh for certificate management using Mesh CA, inject sidecar proxies into services by labeling namespaces, and define PeerAuthentication policies to enforce mTLS. Other configurations, like HTTP Load Balancers or specific firewall rules, may be useful for external traffic management or other purposes, but they are not required for enabling mTLS within the mesh.
- A. Correct.
This step is required to enable automatic issuance and rotation of certificates for secure communication between services within the mesh.
- B. Incorrect.
While an HTTP Load Balancer is often used for external traffic management, it is not directly related to enabling mTLS between services in a Cloud Service Mesh setup.
- C. Correct.
The 'istio-injection=enabled' label ensures that the required sidecar proxy (Istio proxy) is injected into each pod within the namespace, which is critical for enabling service-to-service mTLS.
- D. Correct.
A PeerAuthentication policy is necessary to define the mTLS mode (e.g., strict or permissive) for service-to-service communication.
- E. Incorrect.
Firewall rules for port 80 are not directly relevant to enabling mTLS, as mTLS operates at the application layer and typically uses different ports like 443.