[Solved] You want to enforce mTLS only for service payments in namespace finance, but allow other services to accept plain traffic. Which PeerAuthentication config achieves this? | Kubernetes

Kubernetes - Service Mesh

You want to enforce mTLS only for service payments in namespace finance, but allow other services to accept plain traffic. Which PeerAuthentication config achieves this?

A

<pre>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: permissive-all
  namespace: finance
spec:
  mtls:
    mode: PERMISSIVE</pre>

B

<pre>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: finance-wide
  namespace: finance
spec:
  mtls:
    mode: STRICT</pre>

C

<pre>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: payments-mtls
  namespace: finance
spec:
  selector:
    matchLabels:
      app: payments
  mtls:
    mode: STRICT</pre>

D

<pre>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: payments-disable
  namespace: finance
spec:
  selector:
    matchLabels:
      app: payments
  mtls:
    mode: DISABLE</pre>

Step-by-Step Solution

Solution:

Step 1: Understand requirement
Enforce mTLS STRICT only for 'payments' service, allow others to accept plain traffic.

Step 2: Analyze options

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: payments-mtls
  namespace: finance
spec:
  selector:
    matchLabels:
      app: payments
  mtls:
    mode: STRICT

applies STRICT mode with selector for 'payments' only.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: finance-wide
  namespace: finance
spec:
  mtls:
    mode: STRICT

enforces STRICT for whole namespace, not desired.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: permissive-all
  namespace: finance
spec:
  mtls:
    mode: PERMISSIVE

allows both for all services.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: payments-disable
  namespace: finance
spec:
  selector:
    matchLabels:
      app: payments
  mtls:
    mode: DISABLE

disables mTLS for payments, opposite of requirement.

Final Answer:
PeerAuthentication with selector for payments and STRICT mode -> Option C
Quick Check:
Selector + STRICT = mTLS only for selected service [OK]

Quick Trick: Use selector with STRICT mode for specific service enforcement [OK]

Common Mistakes:

Applying STRICT mode to whole namespace accidentally
Using DISABLE mode when enforcement is needed
Not using selector to target specific service

Master "Service Mesh" in Kubernetes

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

More Kubernetes Quizzes

You want to enforce mTLS only for service payments in namespace finance, but allow other services to accept plain traffic. Which PeerAuthentication config achieves this?

Step 1: Understand requirement

Step 2: Analyze options

Final Answer:

Quick Check:

Want More Practice?