Open3
Mesh Week: Securing Workloads (# 1)
takashi.kanazawaI tried the mock exam provided by Mesh Week at the following link:
Question: Securing Workloads
You want to configure a strict mTLS policy for all workloads in the default namespace with the label mtls: strict set. Additionally, you want to disable mTLS for port 9000 (on the same set of workloads). Create a resource that configures these settings.
takashi.kanazawaAnswer
$ kubectl api-resources | grep peer
peerauthentications pa security.istio.io/v1 true PeerAuthentication
$ vi default-peer-auth.yaml
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
name: default
namespace: default
spec:
selector:
matchLabels:
mtls: strict
mtls:
mode: STRICT
portLevelMtls:
9000:
mode: DISABLE
$ kubectl apply -f default-peer-auth.yaml
peerauthentication.security.istio.io/default created