Kubernetes - Service Mesh
You want to enforce mTLS only between two specific services in a namespace, leaving others unaffected. Which Istio resource should you configure?
You want to enforce mTLS only between two specific services in a namespace, leaving others unaffected. Which Istio resource should you configure?
hard📝 Workflow Q8 of 15
Step-by-Step Solution
Solution:
Step 1: Identify resource for selective mTLS
PeerAuthentication supports selectors to apply policies to specific workloads.Step 2: Exclude other options
Global PeerAuthentication affects all services; DestinationRule DISABLE disables TLS; ServiceEntry is for external services.Final Answer:
PeerAuthentication with selector for those services -> Option BQuick Check:
Selective mTLS uses PeerAuthentication selectors [OK]
Quick Trick: Use PeerAuthentication selectors for specific services [OK]
Common Mistakes:
- Using global policy instead of selector
- Disabling TLS in DestinationRule
- Confusing ServiceEntry with mTLS policy
Master "Service Mesh" in Kubernetes
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore Kubernetes Quizzes