An SRE is debugging why a client in the mesh receives a 503 response when calling a service that has three pods, one of which is in a different namespace and lacks a sidecar. The DestinationRule defines trafficPolicy with connectionPool.http.http1MaxPendingRequests set to 1 and http2MaxRequests set to 1. The SRE wants to eliminate the 503 caused by connection pool exhaustion. Which change addresses the root cause?
You need to restrict traffic to a specific subset of a service defined in a DestinationRule. What should you use in your VirtualService destination block?
You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?
Your team runs a payments service in the 'prod' namespace with a Kubernetes Service named 'payments' listening on port 8443. During a canary rollout you created a Gateway 'payments-gw' in the 'istio-system' namespace and a VirtualService 'payments-vs' in the 'prod' namespace that references the gateway as 'payments-gw'. Clients report HTTP 404 errors when calling the service, but the sidecar-injected payments pods show healthy endpoints and the Gateway pod logs report 'no matching route'. Which change resolves the routing failure?
A platform engineer is migrating a legacy service into the mesh. The service exposes an HTTP API on port 8080 but also a raw TCP admin port on 9090. The engineer wants the sidecar to treat port 8080 as HTTP so that Istio can apply request-level routing, while treating port 9090 as opaque TCP. Which configuration achieves this?
A team wants to shift 10 percent of traffic to a new version of a service for a canary, while keeping 90 percent on the stable version. Both versions are healthy and registered as subsets in a DestinationRule. Which VirtualService configuration accomplishes this?
A mesh operator needs to configure a DestinationRule so that the sidecar reuses existing HTTP/2 connections to an upstream service and automatically ejects endpoints that return repeated 5xx errors. Which two configuration elements are required to meet these goals? (Choose two.)
A developer needs to expose an internal service to external clients through the Istio ingress gateway on port 443 using TLS termination at the gateway. The service listens on port 80 inside the mesh. Which pairing of resources is required?