KCNA Service Mesh 3

Question 1

What is mutual TLS (mTLS) in the context of a service mesh?

Accepted Answer

Both client and server authenticate each other using certificates

Answer

Mutual TLS requires both the client and server to present certificates, ensuring bidirectional identity verification.

Question 2

Which Istio control plane component was historically responsible for certificate issuance and rotation?

Accepted Answer

Citadel

Answer

Citadel was the Istio component that managed service identity and certificate lifecycle, though its functions are now merged into istiod.

Question 3

What does 'PERMISSIVE' mode mean for Istio's peer authentication policy?

Accepted Answer

Both plaintext and mTLS traffic are accepted

Answer

PERMISSIVE mode allows a service to accept both mTLS-encrypted and plaintext connections, useful during migration to strict mTLS.

Question 4

Which open-source service mesh uses a per-node proxy model instead of per-pod sidecars?

Accepted Answer

Cilium Service Mesh

Answer

Cilium Service Mesh uses eBPF-based per-node proxying rather than injecting a sidecar container into every pod.

Question 5

In Linkerd, what is the control plane component called that provides the CLI and dashboard?

Accepted Answer

linkerd-viz

Answer

Linkerd-viz is the extension that provides the web dashboard, metrics, and Tap features for observing traffic.

(KCNA) Kubernetes and Cloud Native Associate Practice Test