CKA Service Mesh Basics 3

Question 1

Which Istio resource is used to register and control traffic to external services (outside the mesh)?

Accepted Answer

ServiceEntry

Answer

ServiceEntry adds external services to Istio's internal service registry, allowing mesh-wide policies and traffic management to apply.

Question 2

In Istio, what is the purpose of PeerAuthentication?

Accepted Answer

Configure mTLS mode between workloads in the mesh

Answer

PeerAuthentication defines how traffic is tunneled, specifying whether mTLS is STRICT, PERMISSIVE, or DISABLED for service-to-service communication.

Question 3

What is the difference between STRICT and PERMISSIVE mTLS mode in Istio?

Accepted Answer

STRICT requires mTLS for all connections; PERMISSIVE accepts both plaintext and mTLS

Answer

In STRICT mode every connection must use mTLS, while PERMISSIVE mode allows both mTLS and plaintext to ease migration of legacy services.

Question 4

Which Istio resource is used to define end-user (JWT) authentication policies?

Accepted Answer

RequestAuthentication

Answer

RequestAuthentication defines what JWT issuers are trusted, validating end-user tokens presented in HTTP requests.

Question 5

An operator wants to allow only GET requests to a service from pods in the 'frontend' namespace. Which Istio resource achieves this?

Accepted Answer

AuthorizationPolicy

Answer

AuthorizationPolicy enforces access control by specifying which sources, operations (methods), and conditions are allowed or denied.

(CKA) Certified Kubernetes Associate Practice Test