Linux Foundation CNPA Dumps Questions Answers

In Istio, PeerAuthentication is used to configure how workloads authenticate traffic coming from other services in the mesh. Option C is correct because PeerAuthentication primarily secures service-to-service communication using mutual TLS (mTLS), ensuring encryption in transit and verifying the identity of both communicating parties.

Option A (network policies for ingress traffic) relates to Kubernetes NetworkPolicy, not Istio PeerAuthentication. Option B (traffic routing) is handled by Istio’s VirtualService and DestinationRule resources. Option D (monitoring/logging) is part of Istio’s telemetry features, not PeerAuthentication.

PeerAuthentication policies define whether mTLS is disabled, permissive, or strict, giving platform teams fine-grained control over how services communicate securely. This aligns with zero-trust security models and ensures compliance with organizational policies without requiring application code changes.

Self-service capabilities are a cornerstone of platform engineering, enabling developers to move quickly while reducing dependency on platform teams. Option C is correct because an automated resource provisioning system allows developers to spin up sandbox or test environments on demand, supporting experimentation and rapid iteration. This aligns with the principle of treating platforms as products, focusing on developer experience and productivity.

Option A (manual request process) creates bottlenecks and is the opposite of self-service. Option B (documentation) is helpful but does not enable automation or self-service. Option D (centralized monitoring) improves observability but is not a self-service capability by itself.

By implementing automated provisioning, developers gain autonomy while platform teams maintain governance through abstractions, golden paths, and policy enforcement. This fosters agility, consistency, and scalability, improving both developer experience and organizational efficiency.

The key distinction is that Helm charts are packaging and deployment tools, while Operators extend Kubernetes controllers to provide ongoing lifecycle management. Option C is correct because Operators continuously reconcile the desired and actual state of custom resources, enabling advanced behaviors like upgrades, scaling, and failover. Helm charts, by contrast, define templates and values for deploying applications but do not actively manage them after deployment.

Option A oversimplifies; Operators do more than deploy, while Helm manages deployment packaging. Option B is incorrect—Helm does not create CRDs by default; Operators often do. Option D is incorrect because Operators and Helm serve different purposes, though they may complement each other.

Operators are essential for complex workloads (e.g., databases, Kafka) that require ongoing operational knowledge codified into Kubernetes-native controllers. Helm is best suited for standard deployments and reproducibility. Together, they improve Kubernetes extensibility and automation.