Exam CKS Topic 4 Question 44 Discussion

Solution (Step by Step) :
1. Configure Network Policies:
- Create Network Policies: use the 'kubectl' command to create network policies that define the communication rules between pods and services. For
example:
bash
kubectl apply -f network-policy-yaml
- Define Rules: Specify the rules in the network policy. For example:

- Apply Policy: Apply the policy using kubectl apply -f network-policy-yaml- 2. Configure Authentication: - Enable Service Account Authentication: Configure service accounts to access the API server. In GKE, you can enable service account authentication by creating a service account key. - Create Service Account Key: Create a service account key with the following command: bash gcloud iam service-accounts keys create service-account-key.json -jam-account service-account@project_iam_gserviceaccount.com - Restrict Access: Configure the service account's permissions to minimize the risk of unauthorized access. Use the IAM policy to grant the service account access only to the required resources. 3. Configure Encryption: - Enable HTTPS for the API Server: In GKE, the API server runs over HTTPS by default. Verify that this is enabled in your cluster configuration. - Configure TLS Certificates: Ensure that the API server uses a valid TLS certificate for secure communication. In GKE, this is typically managed automatically. - Use Mutual TLS: For more robust authentication, configure mutual TLS between the API server and other components. You can use a certificate authority (CA) to issue certificates for each component and configure them for mutual authentication.