Chapter 11: Exploring Istio Security Features

1. True – It is the end user's responsibility to rotate certificates and keys that have been defined for the Ingress gateway in order to secure traffic from external clients and send it to the edge microservice. Note that Istio's Citadel rotates certificates for microservices.
2. True – There can only be one MeshPolicy (with name as the default) that will apply mTLS mesh-wide.
3. True – Mutual TLS can be as granular as possible from the namespace level to the service level by defining a policy.
4. True – Mutual TLS can be enabled through destination rules or by using MeshPolicy.
5. True – Istio is capable of shielding modern microservices applications from running in a zero-trust network without any changes needing to be made to the application code.
6. True – Istio makes VPNs and firewalls redundant...