Advanced Scenarios

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

How can you verify the current configuration being pushed to an Envoy sidecar without using Kiali?

What is the primary function of the 'PeerAuthentication' resource?

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

What is the result of setting 'outlierDetection' in a DestinationRule?

Which Istio component handles the generation of xDS configuration?

What is the main advantage of using Istio's 'locality-aware load balancing'?

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Which tool allows you to perform traffic shifting between two versions of a service?

You want to force all traffic to an external service to go through an EgressGateway. What is required?

When configuring a Gateway API resource, which TWO properties are defined within the 'listeners' block?

When configuring a multi-cluster mesh, what does a 'ServiceEntry' with 'location: MESH_EXTERNAL' signify?

You are troubleshooting a service that is failing to communicate with another service in a different namespace. Which TWO of the following items should you check to ensure connectivity?

Which TWO settings in a DestinationRule are used for load balancing?

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Which THREE of the following are valid ways to control egress traffic in Istio?

Which TWO pieces of information are displayed in the Kiali 'Graph' view?

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

You manage an Istio mesh with two ingress gateways: one public, one private. You need to allow external clients to reach a service through the public gateway, but only if they present a valid client certificate. The private gateway must remain unaffected. Which Istio resource should you configure to enforce this requirement at the public gateway?

You are running an Istio mesh with several clusters. You need to ensure that all outbound traffic from the mesh to external services is visible and controlled. You have already configured a ServiceEntry for an external API at api.external.com. However, you notice that traffic to this API is not being logged in Kiali and no telemetry is collected. What is the most likely cause?

You are troubleshooting a production Istio mesh where a critical service is experiencing intermittent 503 errors. You suspect that the Envoy sidecar is rejecting requests due to a misconfiguration in the DestinationRule. Which Istio command would you use to inspect the Envoy configuration for a specific pod to verify the applied outlier detection settings?

You are deploying a new version of a microservice in your Istio mesh. You want to perform a canary rollout where 10% of traffic goes to the new version, but you also want to ensure that requests from a specific test user always go to the new version regardless of the overall percentage. Which Istio traffic management feature should you use to achieve this?

You are running an Istio mesh in a single Kubernetes cluster and have enabled sidecar injection in the 'payments' namespace. A client pod in that namespace cannot reach an external HTTPS API at api.example.com because the sidecar intercepts all outbound traffic and rejects it. You must allow only that host while keeping traffic to all other unknown external hosts blocked. What should you configure?

Your team wants to ship an application's logs and metrics to a centralized platform without redeploying the application or changing its code. The application already runs with an injected sidecar. Which Istio capability should you use to emit telemetry to an external backend?

A production mesh shows intermittent 503 responses from one service. You suspect the sidecar's circuit breaker is tripping. You need to confirm which outlier-detection and connection-pool settings are active for that destination. Which Istio resource holds these settings, and how do you inspect them at runtime?

You are using Istio's telemetry features to monitor your mesh. You want to collect metrics on the number of requests that result in a 5xx error for a specific service. Which Istio component is responsible for generating these metrics?

You are troubleshooting why a client cannot reach a service in another namespace within the same mesh. The client's sidecar shows the destination cluster exists, but requests fail. You want to verify whether the client's proxy has the correct listener and route for the destination's port. Which istioctl command sequence should you use?