Istio
Medium
Security
A DestinationRule sets trafficPolicy.tls.mode: DISABLE for a host. What happens when that host's Istio PeerAuthentication changes to STRICT?
Select your answer:
Show answer and explanation
Answer: Clients send plain text because of the rule, and their requests fail
Explanation
Auto mTLS only decides what clients send when nothing overrides it, and a DestinationRule with tls.mode DISABLE explicitly turns mutual TLS off on the client side. A STRICT server then rejects those plain-text connections. Remove the tls block or set ISTIO_MUTUAL before locking the host down.
More medium Istio questions
- What is the purpose of Istio's AuthorizationPolicy resource?
- Which of the following is NOT a traffic management feature of Istio?
- What is a 'subset' in Istio's DestinationRule?
- How does Istio implement mutual TLS (mTLS) between services?
- What is the purpose of Istio's PeerAuthentication resource?
- Which component of Istio is responsible for certificate generation and distribution?