Google Professional Cloud Network Engineer Question 311
Select 2Google Cloud PlatformYour organization is implementing a service mesh on Google Cloud using Anthos Service Mesh. You are tasked with ensuring secure communication between microservices deployed on Google Kubernetes Engine (GKE). Which actions should you perform to configure mutual TLS (mTLS) for your service mesh?
- A
Enable automatic sidecar injection for workloads within the service mesh.
- B
Configure a network endpoint group (NEG) for each microservice in the mesh.
- C
Define a PeerAuthentication policy to enforce mTLS for the workloads.
- D
Configure Istio authorization policies to allow or deny traffic based on specific conditions.
- E
Create a custom load balancer for the GKE cluster to handle mTLS termination.
Show answer and explanation
Correct answers: A, C
Explanation
To configure mutual TLS (mTLS) in Anthos Service Mesh, you need to enable automatic sidecar injection so that the Istio sidecar proxy (Envoy) is deployed alongside your workloads. Additionally, defining a PeerAuthentication policy is crucial to enforce mTLS at the workload level. These steps ensure secure communication between microservices within the service mesh. Other options, such as NEGs and custom load balancers, are unrelated to the service mesh's mTLS implementation, and Istio authorization policies serve a different purpose.
- A. Correct.
Enabling automatic sidecar injection ensures that the Istio sidecar proxy (Envoy) is injected into workloads, which is essential for enabling mTLS and service-to-service communication within the service mesh.
- B. Incorrect.
Configuring network endpoint groups (NEGs) is not related to enabling mTLS in a service mesh. NEGs are used for external load balancing and traffic routing, not for service mesh configuration.
- C. Correct.
Defining a PeerAuthentication policy is required to enforce mTLS within Anthos Service Mesh. This policy ensures that communication between workloads in the mesh uses mutual TLS.
- D. Incorrect.
Istio authorization policies are used for fine-grained access control but are not required to configure mTLS. They can complement mTLS by adding additional security layers.
- E. Incorrect.
Creating a custom load balancer for the GKE cluster is not relevant for enabling mTLS within the service mesh. Mutual TLS is handled by the Istio sidecar proxies, not by external load balancers.