ICA Exam Questions and Answers

istioctl analyze

istioctl analyze inspects the cluster's Istio configuration and reports validation errors, warnings and deviations from best practise. It is the dedicated command for confirming that deployed resources are valid and conform to recommended configuration standards.

spec.components.pilot.k8s.replicaCount

Setting replica counts for Istiod belongs under the pilot component, since Istio's control plane daemon is named pilot internally. The IstioOperator schema nests Kubernetes-specific settings beneath `k8s`, so `spec.components.pilot.k8s.replicaCount` is the precise path that satisfies the stem's requirement to scale Istiod replicas.

kubectl label namespace <name> istio-injection=enabled

Labelling the namespace with `istio-injection=enabled` triggers Istio's mutating admission webhook, which automatically injects the sidecar proxy into every pod created there. This satisfies the stem's constraint of enabling injection without editing deployment manifests, since the injection happens at pod admission rather than in the workload definition.

minimal

The minimal profile installs only istiod, the ingress gateway and the istio-cni component, omitting telemetry add-ons such as Prometheus, Grafana and Jaeger. This directly satisfies the requirement to disable unnecessary features and conserve cluster resources in the development environment.

default

The default profile provides the full set of capabilities with no restrictions, so it supports the redundancy and throughput a production deployment demands. Restricted profiles strip features for security or testing, which would undermine the high availability and performance the stem requires.

Update label and restart pods

Updating the `istio.io/rev` label to `1-19` and restarting pods triggers sidecar injection from the new revision's mutating webhook, satisfying the requirement to migrate the namespace between revisions. Existing pods retain their old sidecar until restarted, so the restart is essential to complete the move.

istiod

Istiod acts as the control plane's configuration translator: it watches Gateway resources, merges them with VirtualService routing, and pushes the resulting Envoy listener, route and cluster configuration to the sidecars and ingress gateways via xDS. Without istiod, the Gateway spec would never become proxy config.

The traffic is encountering high error rates or being blocked by an Istio policy.

Kiali renders red edges when the destination workload reports elevated error responses or when an Istio authorisation or traffic policy rejects requests. This colouring reflects the measured error rate on that edge, not latency or throughput, so it points to failures or policy blocks.

Gateway

Gateway defines the listener configuration and ports that expose the mesh to inbound traffic, satisfying the requirement for a dedicated entry point. It binds to a GatewayClass and routes requests onward via HTTPRoute resources, separating infrastructure-level ingress from application routing rules.

Sidecar resource

The Sidecar resource scopes a workload's proxy to a defined set of namespaces and services, limiting which registries and endpoints it receives. This directly satisfies the multi-tenancy constraint by preventing cross-namespace visibility, unlike PeerAuthentication or AuthorizationPolicy, which govern mTLS and access rather than discovery scope.

istioctl proxy-config

istioctl proxy-config reads the sidecar's live Envoy configuration directly from the proxy, showing clusters, listeners, routes and endpoints. It satisfies the constraint of verifying pushed configuration without Kiali, querying the data plane rather than relying on the dashboard.

Configure mTLS mode for workloads.

PeerAuthentication defines the mutual TLS mode Istio applies to workloads in a namespace or mesh, satisfying the requirement to control service-to-service encryption. Its mtls.mode field accepts STRICT, PERMISSIVE or DISABLE, governing whether sidecars accept plaintext alongside encrypted traffic. This makes it the resource for configuring workload mTLS behaviour.

interval

In `outlierDetection`, `interval` sets how often Envoy scans each host's ejection status, satisfying the requirement for a timing parameter governing consecutive failure evaluation. It works alongside `consecutiveErrors` and `baseEjectionTime`; without it, ejection checks would lack a defined polling cadence, so it belongs among the three valid settings.

baseEjectionTime

baseEjectionTime sets how long an ejected host stays out of the load-balancing pool before being returned, directly satisfying the outlierDetection requirement to define ejection duration. It pairs with consecutive5xxErrors and interval to complete the detection cycle, making it one of the three valid outlierDetection fields in a DestinationRule.

consecutive5xxErrors

Consecutive5xxErrors belongs to the outlierDetection block, defining how many consecutive HTTP 5xx responses an endpoint may return before Envoy ejects it from the load-balancing pool. This satisfies the stem's requirement for a genuine outlierDetection field, alongside consecutiveGatewayErrors and interval/baseEjectionTime.

abort

The abort fault injects a specified HTTP status code, so setting abort with httpStatus 503 and percentage 20 returns 503 for one fifth of catalog requests. This directly satisfies the stem's requirement to simulate service unavailability rather than delay.

DestinationRule

The `trafficPolicy.connectionPool.tcp.maxConnections` field in a DestinationRule caps concurrent TCP connections to the payment service at 100. Istio applies this limit at the sidecar proxy when initiating upstream connections, satisfying the stem's concurrency constraint without altering the service itself.

DestinationRule

DestinationRule hosts traffic policies for a service, including connectionPool settings that cap concurrent connections and pending requests to order-service. This limits in-flight connections, preventing one slow dependency from exhausting resources and causing cascading failures across the mesh.

It is ejected for 30 seconds

Outlier detection ejects the host for baseEjectionTime once consecutive 5xx errors reach the threshold within the interval. Five errors in one second triggers ejection, so the host is removed from the load-balancing pool for 30 seconds.

timeout

The timeout field in the VirtualService's HTTP route specifies how long a request may run before Istio aborts it, so setting it to 2s enforces the required limit on the orders service. Other fields control retries, faults or matching, not request duration.

VirtualService

Istio splits traffic through VirtualService routing rules, where weighted destinations distribute percentages across subsets. Configuring a 90/10 weight split in the VirtualService's HTTP route satisfies the requirement to send 10% of traffic to the new version.

http routes

The http routes block is mandatory: it defines the match conditions and destination subsets that split traffic between stable and canary versions. Without it, the VirtualService has no routing rules to weight, so canary splitting cannot occur.

weight

Weight assigns each route a proportional share of traffic, for example 90 to stable and 10 to canary. It is the mechanism that actually performs the gradual shift, and it must be set on the routes within the http block.

hosts

Specifying hosts binds the VirtualService to the target service's DNS names, ensuring canary traffic routing applies to the correct destination. Without matching hosts, Istio cannot associate the routing rules with inbound requests, so the weighted split between stable and canary subsets never takes effect.

VirtualService

VirtualService HTTP route rules carry a timeout field that caps the total duration of a request to the destination, so setting it to 5s enforces the limit. DestinationRule governs connection pooling and outlier detection, not request timeouts.

selector

The selector field is mandatory because it defines which pods the Gateway's configuration applies to, using label matching. Without it, the Gateway resource cannot bind to any workload, so Istio rejects the manifest during validation.

servers

The servers field is mandatory because it declares the ports, protocols and TLS settings the Gateway listens on. Omitting it leaves the Gateway with no listener configuration, so the resource fails validation and no ingress traffic can be accepted.

Gateway

Gateway configures a standalone Envoy at the mesh edge, opening the listener ports and hosts that admit external traffic. This satisfies the constraint of defining the entry point, since inbound requests must match the Gateway's servers before a VirtualService can bind and route them.

DestinationRule spec

The subset's label selector lives in the DestinationRule spec, under subsets[].labels. If those labels do not match the pod labels, no endpoints populate the subset and traffic fails, so that is where the match must be verified.

Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.

AuthorizationPolicy source.ipBlocks matches the originating IP against the specified CIDR ranges, so only requests from 10.0.0.0/24 are permitted to reach the payments service. Other sources are denied, enforcing the security team's origin restriction at the Envoy layer.

Allow all traffic.

With no AuthorizationPolicy bound to a workload, Istio's default posture is permissive: requests reaching the sidecar are forwarded without authorisation checks. This satisfies the stem's "no policy present" constraint, since enforcement only activates once a policy selects the workload. Traffic is therefore allowed by default.

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.

The 'when' condition with key request.auth.claims[custom-claim] matches the validated JWT claim against the listed values, so the policy allows or denies based on that claim. This satisfies the stem's constraint of authorising users via a custom JWT claim.

Envoy Proxy

Envoy Proxy runs as the sidecar enforcing AuthorizationPolicy decisions at the workload level. Istiod distributes the policy configuration, but the actual allow or deny enforcement on each request happens inside the Envoy filter chain, satisfying the requirement for workload-level enforcement.

The legacy service is not using an Istio sidecar to handle mTLS handshakes.

STRICT mode rejects plaintext traffic, so every workload in the namespace must present a sidecar-managed certificate. A legacy service without an injected sidecar cannot complete the mTLS handshake, since no Envoy proxy terminates TLS on its behalf. The namespace-wide policy therefore blocks it, satisfying the stem's encryption constraint.

Trust domain

A SPIFFE ID follows the spiffe:// URI form, where the trust domain is the authority component identifying the issuing trust root, followed by the workload path; the trust domain is therefore one of the three constituent parts.

Service Account

An Istio SPIFFE ID follows the format spiffe://trust-domain/ns/namespace/sa/service-account, so the Service Account is one of its constituent fields. It identifies the workload's Kubernetes service account identity, satisfying the stem's requirement for items included in the SPIFFE ID.

Namespace

A SPIFFE ID follows the spiffe://trust-domain/path format, where the path typically encodes workload identity components including the Kubernetes namespace. Namespace therefore forms part of the identity, satisfying the stem's requirement by distinguishing workloads across tenants.