ICA Istio Installation Upgrade And Configuration — Timed 10 Questions

Question 1

You are performing a canary upgrade of the Istio control plane using the revision-based approach. After deploying the new revision, how do you verify which pods are currently pointing to the new control plane?

10 minute time limit — choose an answer to begin.

Accepted Answer

kubectl get pods -l istio.io/rev. You verify the configuration by checking the 'istio.io/rev' label on the pods to see which revision they are assigned to.

Answer

istioctl upgrade status

Answer

istioctl proxy-config endpoint

Answer

kubectl describe svc istiod

Question 2

Which 'istioctl' command is used to verify that the current Istio configuration in a cluster is valid and follows best practices?

Accepted Answer

istioctl analyze. The 'istioctl analyze' command inspects the cluster and identifies configuration errors or warnings.

Answer

istioctl check

Answer

istioctl diagnose

Answer

istioctl verify

Question 3

When using IstioOperator to customize the installation, you want to change the number of replicas for the Istiod control plane. Where should this be defined?

Accepted Answer

spec.components.pilot.k8s.replicaCount. The 'spec.components.pilot.k8s.hpaSpec' or 'spec.components.pilot.k8s.replicaCount' fields are the correct places to define scale for the pilot component.

Answer

spec.values.pilot.scaling

Answer

spec.meshConfig.pilot.replicas

Answer

spec.pilot.replicas

Question 4

A team wants to enable sidecar injection for a specific namespace without modifying the deployment manifests. What is the most efficient way to achieve this?

Accepted Answer

kubectl label namespace <name> istio-injection=enabled. Labeling the namespace with 'istio-injection=enabled' triggers the sidecar injector webhook to automatically inject proxies into new pods.

Answer

istioctl inject -n <namespace>

Answer

kubectl apply -f sidecar-injector.yaml

Answer

kubectl annotate namespace <name> istio-injection=enabled

Question 5

You need to add a custom CA certificate to the Istio control plane during installation. How do you pass this using IstioOperator?

Accepted Answer

spec.values.global.certificates.caCertificates. You use the 'spec.values.global.certificates' or specific secret mounts to provide custom certificates to Istiod.

Answer

spec.meshConfig.caCertificates

Answer

spec.components.pilot.k8s.env

Answer

spec.security.ca.path

Question 6

You need to configure the IstioOperator CR to disable mTLS globally for a legacy migration. Which field correctly sets the global peer authentication policy?

Accepted Answer

spec.values.global.mtls.enabled: false. The 'spec.meshConfig.defaultConfig.peerAuthenticationPolicy' is not the correct path; the global mTLS setting is handled via 'spec.values.global.mtls.enabled'.

Answer

spec.components.pilot.mtls: false

Answer

spec.meshConfig.mtls: false

Answer

spec.security.globalMtls: false

Question 7

You are installing Istio for a development cluster and want to use a predefined configuration that includes the core components but disables unnecessary features like telemetry to save resources. Which profile should you choose?

Accepted Answer

minimal. The 'minimal' profile installs only the base resources and the control plane, making it ideal for resource-constrained development environments.

Answer

preview

Answer

demo

Answer

default

Question 8

You are performing an in-place upgrade of Istio. You have updated the control plane, but your data plane proxies are still running the old image. What is the standard process to upgrade the proxies?

Accepted Answer

kubectl rollout restart deployment. To upgrade the data plane proxies, you must perform a rolling restart of the pods to trigger the injector to pull the new sidecar image.

Answer

istioctl upgrade --data-plane

Answer

kubectl patch deployment -p '{"spec":{"template":{"metadata":{"annotations":{"sidecar.istio.io/status":"update"}}}}}'

Answer

istioctl proxy-status --upgrade

Question 9

Which profile is recommended for a production environment where high availability and performance are required?

Accepted Answer

default. The 'default' profile is optimized for production use cases with HA settings enabled.

Answer

minimal

Answer

empty

Answer

demo

Question 10

You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?

Accepted Answer

Update label and restart pods. You must update the 'istio.io/rev' label on the namespace to the new revision and then perform a rolling restart of the pods in that namespace.

Answer

Use 'istioctl install --revision 1-19' on the namespace

Answer

Update label and run 'istioctl proxy-config rev 1-19'

Answer

Just update the label; Istio handles it automatically