Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ331

Integrating applications with Google Cloud services

You operate a microservices application on Google Kubernetes Engine (GKE) with Istio. You protect the communication channels between your microservices by implementing an Istio AuthorizationPolicy, a Kubernetes NetworkPolicy, and mTLS on the GKE cluster. You find that HTTP requests between two Pods to certain URLs fail, while requests to other URLs succeed. What is causing the connection issue?

  • A A Kubernetes NetworkPolicy resource is blocking HTTP traffic between the Pods.
  • B The Pod initiating the HTTP requests is attempting to connect to the target Pod via an incorrect TCP port.
  • C The Authorization Policy of your cluster is blocking HTTP requests for specific paths within your application.
  • D The cluster has mTLS configured in permissive mode, but the Pod's sidecar proxy is sending unencrypted traffic in plain text.
Explanation

Istio AuthorizationPolicy supports Layer 7 access controls, including HTTP request paths. A policy that denies, or does not allow, particular paths can therefore block only requests to those URLs. Kubernetes NetworkPolicy operates at the network and transport layers, controlling Pods, IP addresses, and ports rather than HTTP paths; port or mTLS configuration issues would not normally be URL-specific.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!