Kubernetes and Cloud Native CNPA Book

Mutual TLS (mTLS) is a core feature of service meshes, such as Istio or Linkerd, that enhances security in cloud native environments by ensuring that both communicating services authenticate each other and that the communication channel is encrypted. Option A is correct because mTLS delivers two critical benefits: authentication (verifying the identity of both client and server services) and encryption (protecting data in transit from interception or tampering).

Option B is incorrect because mTLS does not bypass security—it enforces it. Option C is partly true in that service meshes often support observability and logging, but that is not the primary purpose of mTLS. Option D relates to scaling, which is outside the scope of mTLS.

In platform engineering, mTLS is a fundamental security mechanism that provides zero-trust networking between microservices, ensuring secure communication without requiring application-level changes. It strengthens compliance with security and data protection requirements, which are crucial in regulated industries.

The most sustainable solution for managing developer access while balancing governance and self-service is to adopt GitOps-based RBAC management. Option A is correct because it leverages Git as the source of truth for access permissions, allowing developers to request access through pull requests. For non-sensitive environments such as staging, approvals can be automated, ensuring efficiency while still maintaining auditability. This approach aligns with platform engineering principles of self-service, automation, and compliance.

Option B places the burden entirely on one engineer, which does not scale. Option C introduces bottlenecks, delays, and reduces developer experience. Option D bypasses governance and auditability, potentially creating security risks.

GitOps for RBAC not only improves developer experience but also ensures all changes are versioned, reviewed, and auditable. This model supports compliance while reducing manual intervention from the platform team, thus enhancing efficiency.

Role-Based Access Control (RBAC) in Kubernetes is a cornerstone of cluster security, enabling fine-grained access control based on the principle of least privilege. Option D is correct because RBAC leverages Roles (or ClusterRoles) that define sets of permissions, and RoleBindings (or ClusterRoleBindings) that assign those roles to users, groups, or service accounts. This mechanism ensures that users have only the minimum required access to perform their tasks, enhancing both security and governance.

Option A is incorrect because RBAC fully supports namespace-scoped roles, allowing isolation of permissions at the namespace level in addition to cluster-wide roles. Option B is wrong because RBAC is specifically designed to restrict, not grant, unrestricted access. Option C is misleading because RBAC applies broadly across Kubernetes API resources, not just Pods—it includes ConfigMaps, Secrets, Deployments, Services, and more.

By applying RBAC correctly, platform teams can align with security best practices, ensuring that sensitive operations (e.g., managing secrets or modifying cluster configurations) are tightly controlled. RBAC is also central to compliance frameworks, as it provides auditability of who has access to what resources.

Developer portals like Backstage act as the single entry point for platform services, APIs, golden paths, and documentation. Option A is correct because centralizing access greatly reduces the friction developers face when trying to adopt a new platform. Instead of searching across fragmented systems or learning low-level Kubernetes details, developers can find everything in one place, including templates, service catalogs, automated workflows, and governance policies.

Option B is irrelevant to platform adoption. Option C may foster community sharing but does not directly address adoption challenges. Option D contradicts platform engineering principles, which emphasize democratizing access and self-service rather than restricting tools to senior developers.

By providing a unified experience, portals improve discoverability, consistency, and self-service. They reduce cognitive load and support the platform engineering principle of improving developer experience, making adoption of new platforms smoother and more efficient.