You manage a microservices application on Google Kubernetes Engine (GKE) using Istio. You secure the communication channels between your microservices by implementing an Istio AuthorizationPolicy, a…

Question

Options

• AA Kubernetes NetworkPolicy resource is blocking HTTP traffic between the Pods.
• BThe Pod initiating the HTTP requests is attempting to connect to the target Pod via an incorrect
• CThe Authorization Policy of your cluster is blocking HTTP requests for specific paths within your
• DThe cluster has mTLS configured in permissive mode, but the Pod's sidecar proxy is sending

• A
  18% (6)
• B
  9% (3)
• C
  70% (23)
• D
  3% (1)

Explanation

The correct answer is C: The Istio AuthorizationPolicy is blocking HTTP requests for specific paths. The key diagnostic clue is that only requests to specific URLs fail while other requests to the same pods succeed. A Kubernetes NetworkPolicy (A) operates at the IP/port level - it either allows or blocks all traffic between pods, not traffic to specific URL paths. An incorrect port (B) would cause all connections to the target pod to fail, not just specific URLs. An mTLS configuration issue in permissive mode (D) would affect all connections between the pods uniformly. Istio's AuthorizationPolicy is the only mechanism in this stack that can enforce path-based access control rules, meaning an allow or deny rule scoped to specific HTTP paths (e.g., /admin, /internal) is the root cause of selective URL-level failures.

No community discussion yet for this question.