CKSKubernetes 1.35

Exercises

Exercise: STRICT mTLS in the namespace

updated 2026-10-22 by seed

Host: controlplane · Time: 10 min · Domain: Minimize Microservice Vulnerabilities

Task

  • All Pod-to-Pod traffic inside prod must use mutual TLS in STRICT mode.
  • Workloads must stay routable from each other.

Acceptance criteria

  • kubectl get peerauthentication -n prod -o yaml shows mode: STRICT.
  • The namespace is labelled for sidecar injection and the Pods have 2 containers.
  • A plaintext client from outside the mesh is refused.

Solution (Istio present)

kubectl label namespace prod istio-injection=enabled --overwrite
kubectl rollout restart deployment -n prod
cat <<'EOF' | kubectl apply -f -
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: {name: default, namespace: prod}
spec:
  mtls:
    mode: STRICT
EOF
kubectl get pods -n prod            # 2/2 READY

Solution (no mesh)

State it, then implement certificate-based mTLS: a CA, a server cert requiring a
client cert, both in Secrets, and the app configured with ssl.ClientAuth.
The exam's own quick reference documents this path — an honest "no mesh installed"
plus a working cert setup scores better than a PeerAuthentication object that
nothing enforces.

Cilium alternative: encryption.type=wireguard in the Cilium values, then
cilium encryption status must report Wireguard: Enabled.