ICA Traffic Management — 10 Questions

Question 1

Which command is used to view the current Istio configuration resources in a namespace?

Accepted Answer

kubectl get. Istio configuration resources — VirtualService, DestinationRule, Gateway, ServiceEntry, etc. — are Kubernetes Custom Resources (CRDs), so they are viewed with standard kubectl commands such as 'kubectl get virtualservices -n <namespace>' or 'kubectl get destinationrules'. The istioctl tool is used for analysis, debugging, and proxy inspection, not for listing configuration resources.

Answer

istioctl proxy-config

Answer

istioctl dashboard

Answer

istioctl analyze

Question 2

What is the purpose of the 'sidecar' resource in Istio?

Accepted Answer

To limit the configuration sent to a proxy. Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.

Answer

To encrypt traffic

Answer

To manage external services

Answer

To define load balancing

Question 3

How do you configure a connection timeout for an external service?

Accepted Answer

VirtualService timeout. In the VirtualService, the timeout field defines the request timeout duration.

Answer

EnvoyFilter

Answer

DestinationRule

Answer

ServiceEntry

Question 4

When a request fails, where can you check the reason for the failure in the Istio ecosystem?

Accepted Answer

Kiali. Kiali provides visual traffic flow analysis and error code identification.

Answer

DestinationRule status

Answer

istioctl analyze

Answer

Gateway logs

Question 5

How do you define a circuit breaker that trips after 3 consecutive errors?

Accepted Answer

DestinationRule. The outlierDetection field in DestinationRule uses consecutiveGatewayErrors.

Answer

ServiceEntry

Answer

Gateway

Answer

VirtualService

Question 6

How do you limit the number of active requests to a service?

Accepted Answer

DestinationRule. The connectionPool field in DestinationRule supports maxRequestsPerConnection.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 7

You need to route traffic for an external service that uses TLS. How do you configure the ServiceEntry?

Accepted Answer

By creating a ServiceEntry with resolution DNS. The ServiceEntry must define resolution and location, and the destination port must specify the protocol.

Answer

By using an EnvoyFilter

Answer

By creating a Gateway

Answer

Using a VirtualService only

Question 8

How do you configure an Istio Gateway to handle HTTPS?

Accepted Answer

Gateway. A Gateway requires a 'servers' block with 'tls' settings and a reference to a Kubernetes secret.

Answer

DestinationRule

Answer

VirtualService

Answer

ServiceEntry

Question 9

Which command helps you check if a specific VirtualService is active?

Accepted Answer

kubectl get virtualservices. istioctl proxy-config routes <pod-name> will show if the route exists in the proxy.

Answer

kubectl logs

Answer

istioctl get routes

Answer

istioctl check

Question 10

What happens if you have two VirtualServices for the same host?

Accepted Answer

They are merged. Istio merges them if possible, or the behavior is undefined/conflicting depending on the match criteria.

Answer

The last one wins

Answer

Both ignored

Answer

Error thrown