ICA Advanced Scenarios — 20 Questions

Question 1

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

Accepted Answer

A shared 'cacerts' secret containing the root CA certificate.. For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.

Answer

A ServiceEntry with 'resolution: DNS'.

Answer

An AuthorizationPolicy allowing all traffic.

Answer

An EgressGateway with TLS origination.

Question 2

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

Accepted Answer

istiod. The istiod control plane watches the Kubernetes Gateway API resources and generates the corresponding Envoy proxy configuration.

Answer

The Kiali operator

Answer

The Envoy proxy sidecar

Answer

The ingress-gateway deployment

Question 3

You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?

Accepted Answer

The traffic is encountering high error rates or being blocked by an Istio policy.. In Kiali, a red line indicates that traffic is failing or being rejected by an Istio policy.

Answer

The services are located in different clusters.

Answer

The service is not part of the mesh.

Answer

The connection is encrypted using mTLS.

Question 4

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

Accepted Answer

Gateway. The Gateway resource defines the entry point, including listeners, ports, and protocols.

Answer

Service

Answer

Ingress

Answer

HTTPRoute

Question 5

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

Accepted Answer

Sidecar resource. Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.

Answer

DestinationRule

Answer

VirtualService

Answer

PeerAuthentication

Question 6

You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?

Accepted Answer

Configure an AuthorizationPolicy in Namespace Y with a 'DENY' action for all principals.. AuthorizationPolicies are the primary tool for fine-grained access control. A 'deny-all' policy in the target namespace followed by explicit permit rules enforces strict isolation.

Answer

Set the global mesh config to 'REGISTRY_ONLY'.

Answer

Remove the service accounts from the mesh.

Answer

Use Kubernetes NetworkPolicies instead of Istio.

Question 7

In a primary-remote multi-cluster deployment with a shared control plane, a remote cluster service is unreachable. You observe the ServiceEntry is created correctly, but the remote cluster does not have the corresponding Service object. What is the most likely cause?

Accepted Answer

The remote cluster's kubeconfig is missing from the primary cluster's secret store.. In a shared control plane model, the primary cluster's control plane must be able to reach the remote cluster's Kubernetes API server to watch for service changes and push endpoints.

Answer

The mesh expansion service is not running on the remote cluster.

Answer

The Istio sidecar injection is disabled on the remote cluster.

Answer

The global namespace is missing a ServiceEntry.

Question 8

You are configuring Jaeger for distributed tracing in Istio. You observe that traces are missing spans for external service calls. What is the most likely cause?

Accepted Answer

The application is not propagating the trace headers.. Tracing relies on the propagation of B3 or W3C Trace Context headers. If external services do not support this, the trace chain is broken.

Answer

The Jaeger collector is not configured in istio-system.

Answer

The sidecar is not configured for egress.

Answer

The MeshConfig 'sampling' value is too low.

Question 9

How can you verify the current configuration being pushed to an Envoy sidecar without using Kiali?

Accepted Answer

istioctl proxy-config. The 'istioctl proxy-config' command allows users to inspect the current state of the Envoy proxy.

Answer

istioctl analyze

Answer

kubectl get virtualservice

Answer

kubectl describe pod

Question 10

What is the primary function of the 'PeerAuthentication' resource?

Accepted Answer

Configure mTLS mode for workloads.. PeerAuthentication allows you to define the mTLS mode (STRICT, PERMISSIVE, DISABLE) for workloads within a namespace or the entire mesh.

Answer

Apply rate limits to requests.

Answer

Limit egress traffic to external sites.

Answer

Route traffic based on headers.

Question 11

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

Accepted Answer

To allow the control plane to manage the remote cluster's services.. The secret allows the control plane in the primary cluster to authenticate and access the Kubernetes API of the remote cluster.

Answer

To store custom headers for cross-cluster traffic.

Answer

To identify the cluster in the mesh.

Answer

To encrypt traffic between clusters.

Question 12

In a multi-cluster Istio setup, you notice that service 'A' in cluster 1 cannot communicate with service 'B' in cluster 2, even though 'Cross-Cluster' is enabled. The logs show '404 Not Found'. What is the most likely reason?

Accepted Answer

Service 'B' is not exported to the local cluster via an ExportTo policy.. Even with multi-cluster discovery, services must be explicitly defined in the mesh registry via ServiceEntry, or the internal DNS name must be resolvable.

Answer

The sidecar image versions differ.

Answer

The cluster network is not configured in meshConfig.

Answer

The istio-ingressgateway is not installed.

Question 13

Which component in Istio is responsible for collecting telemetry data and sending it to observability tools like Prometheus?

Accepted Answer

Telemetry. The Istio Telemetry component, often integrated into the sidecar and processed by the Istio control plane, handles data collection.

Answer

Envoy

Answer

Jaeger

Answer

Kiali

Question 14

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

Accepted Answer

The Envoy 'buffer' filter configuration.. The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.

Answer

The 'tcp-metadata' filter.

Answer

The 'outlier-detection' settings.

Answer

The 'circuit-breaker' settings.

Question 15

You notice that your Kiali dashboard shows services as 'missing'. What is a likely cause?

Accepted Answer

The namespace is excluded from Kiali's configuration.. If Kiali cannot find the service in the registry, it is likely because the namespace is not included in the Kiali configuration or the service lacks proper labels.

Answer

The sidecar is missing.

Answer

The Prometheus data retention period is too short.

Answer

The gateway is not configured correctly.

Question 16

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

Accepted Answer

HTTPRoute. HTTPRoute is the specific Gateway API resource for routing HTTP traffic based on hostnames, paths, and headers.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 17

What is the result of setting 'outlierDetection' in a DestinationRule?

Accepted Answer

Unhealthy endpoints are temporarily ejected from the load balancing pool.. Outlier detection automatically ejects unhealthy hosts from the load balancing pool based on failure thresholds.

Answer

Logs are sent to a remote collector.

Answer

Traffic is automatically retried.

Answer

Connections are encrypted.

Question 18

Which Istio component handles the generation of xDS configuration?

Accepted Answer

istiod. Istiod is the monolithic control plane component that computes the configuration for all sidecars.

Answer

Kiali

Answer

Envoy

Answer

Prometheus

Question 19

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Question 20

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Accepted Answer

The number of requests that exceeded the timeout to an upstream service.. This metric indicates the number of requests that timed out while waiting for a response from the upstream service.

Answer

The average time of all requests.

Answer

The total number of upstream connections.

Answer

The number of successful requests.