CCNA Resilience And Fault Injection Questions

idleTimeout is a genuine field within the http connectionPool configuration, specifying how long an unused connection is retained before being closed. It satisfies the stem's requirement by belonging to that connectionPool block, alongside http2MaxRequests and maxRequestsPerConnection.

The `trafficPolicy.connectionPool.tcp.maxConnections` field in a DestinationRule caps concurrent TCP connections to the payment service at 100. Istio applies this limit at the sidecar proxy when initiating upstream connections, satisfying the stem's concurrency constraint without altering the service itself.

When the configured timeout elapses without a response, Envoy terminates the upstream request and returns HTTP 504 Gateway Timeout to the caller, distinguishing it from a 503 returned by fault injection or an unavailable endpoint.

consecutive5xxErrors sets how many sequential server errors an endpoint must return before it is ejected from the load-balancing pool. This satisfies the resilience constraint by removing unhealthy hosts quickly, preventing repeated failures reaching a degraded instance.

Five consecutive 5xx responses is the default threshold before Istio's outlier detection ejects a host from the load-balancing pool. This satisfies the stem's request for the out-of-the-box `consecutive5xx` value, which applies per host within the interval, requiring no explicit configuration in the DestinationRule.

Setting `trafficPolicy.connectionPool.tcp.maxConnections` caps concurrent TCP connections to the 'orders' service, directly satisfying the stem's requirement to limit connection count. Istio's connection pool settings apply per destination host, so this field throttles simultaneous connections at the sidecar before requests reach the workload.

The timeout field in an HTTP route specifies the maximum time a request can take before it is aborted. When the timeout is exceeded, Istio returns a 504 Gateway Timeout to the client. Setting this field to 5s ensures that requests taking longer than 5 seconds are terminated with the appropriate error. This directly fulfills the scenario's requirement.

DestinationRule hosts traffic policies for a service, including connectionPool settings that cap concurrent connections and pending requests to order-service. This limits in-flight connections, preventing one slow dependency from exhausting resources and causing cascading failures across the mesh.

Fault injection scopes the effect using a percentage object containing a value field, which specifies the proportion of requests that receive the fault. This satisfies the constraint of applying the fault to only part of the traffic rather than all of it.

Outlier Detection counts consecutiveGatewayErrors, which covers gateway failures such as connection refused or reset, and ejects the host once the threshold is exceeded. This satisfies the stem's requirement that gateway failures be a common ejection cause.

When the configured timeout is shorter than the service's average response latency, Envoy aborts the upstream request before the backend can reply, returning a 504 to the caller. This directly satisfies the stem's constraint: a timeout below average latency produces gateway timeout errors.

Outlier detection ejects individual unhealthy hosts from the load-balancing pool based on consecutive 5xx errors or gateway failures, whereas circuit breaking trips at the connection-pool level, rejecting requests once pending or active connection limits are exceeded. The stem's contrast between host health and request load is satisfied precisely by this split.

Istio's VirtualService resource supports fault injection natively, letting you configure HTTP delays or aborts against a host without altering application code. This satisfies the stem's requirement for a valid fault injection method, since the delay is applied at the service-mesh proxy layer during request routing.

A timeout of 2s declared in the VirtualService route rule caps how long Envoy waits for the search service before returning an error, delivering the required fail-fast behaviour. The timeout applies per route, so the request is abandoned at two seconds rather than hanging.

Header-based matches in a VirtualService let you route only requests carrying a specific test header to the fault-injected subset, leaving ordinary production traffic untouched. This satisfies the stem's constraint of testing fault injection in production without disrupting live users, since Istio evaluates match conditions before applying the abort or delay rule.

Raising consecutive5xx requires multiple successive failures before ejection, preventing a single transient error from removing the pod. Increasing the interval lengthens the analysis window, so failures must persist across a longer period. Together these satisfy the stem's demand that ejection occur only after consistent failure.

The abort fault injects a specified HTTP status code, so setting abort with httpStatus 503 and percentage 20 returns 503 for one fifth of catalog requests. This directly satisfies the stem's requirement to simulate service unavailability rather than delay.

A timeout bounds how long a caller waits, releasing the thread, connection and memory tied to that request once the deadline passes. This directly prevents resource exhaustion from hanging requests, satisfying the stem's stated purpose.

Setting `consecutive5xx: 5` instructs the sidecar's outlier detector to eject a host after five successive 5xx responses, directly matching the stem's threshold. Other consecutive-error counters, such as `consecutiveGatewayErrors`, track different status classes and would not trigger on generic 5xx failures.

baseEjectionTime sets the duration a pod stays ejected from the load-balancing pool before being returned for health re-evaluation. This directly satisfies the stem's requirement: it is the field governing how long an ejected pod remains out of rotation, measured from the moment of ejection.

maxEjectionPercent defines the maximum percentage of endpoints in the load-balancing pool that can be ejected simultaneously. Setting it to a value like 40 ensures that even if many hosts fail, at least 60% remain available to serve traffic. This directly controls how many hosts can be ejected, which is one of the two requirements in the scenario.

Envoy evaluates the response against the retryOn condition, comparing the returned status code or reset type to the configured list. Only matching failures trigger the retry budget, so non-matching errors pass straight back to the caller.

Connection pool limits and circuit breaker thresholds for a service are configured in the DestinationRule under trafficPolicy.connectionPool. The tcp and http subsections define maximum connections and pending requests respectively. This is the correct location because DestinationRules define policies that apply after routing, including connection-level controls for the selected service.

Istio's outlier detection ejects a host once its consecutive 5xx responses reach the value set in consecutive5xxErrors, counted per host over the interval. This field directly governs the ejection threshold, unlike interval or baseEjectionTime, which control timing rather than the error count.

The timeout field in the VirtualService's HTTP route specifies how long a request may run before Istio aborts it, so setting it to 2s enforces the required limit on the orders service. Other fields control retries, faults or matching, not request duration.

Outlier detection ejects the host for baseEjectionTime once consecutive 5xx errors reach the threshold within the interval. Five errors in one second triggers ejection, so the host is removed from the load-balancing pool for 30 seconds.

http1MaxPendingRequests caps how many HTTP/1.1 requests may queue awaiting a connection, directly satisfying the requirement to limit pending requests. Istio's circuit breaker uses this field to shed load once the threshold is exceeded, returning overflow failures rather than allowing unbounded queueing.

In `outlierDetection`, `interval` sets how often Envoy scans each host's ejection status, satisfying the requirement for a timing parameter governing consecutive failure evaluation. It works alongside `consecutiveErrors` and `baseEjectionTime`; without it, ejection checks would lack a defined polling cadence, so it belongs among the three valid settings.

Shorter interval = faster checks.

connectionPool is a valid trafficPolicy field, defining TCP connection limits such as maxConnections, connectTimeout and HTTP limits for the destination. It controls how Envoy manages upstream connections, making it a legitimate setting within a DestinationRule's traffic policy.

Increasing the interval makes the detector scan less frequently, reducing the likelihood of premature ejection.

DestinationRule defines traffic policies for a service, including connection pool limits and outlier detection, which ejects unhealthy hosts to achieve circuit breaking. This satisfies the stem's requirement for the resource that configures circuit breaking, as opposed to routing (VirtualService) or gateway configuration.

When the outlier detection thresholds are breached, the circuit breaker ejects the unhealthy endpoint from the load-balancing pool. Envoy then stops routing new requests to that instance, giving it time to recover while traffic flows to remaining healthy endpoints.

Envoy sidecar proxies enforce circuit breaking and fault injection at the data plane, applying the outlier detection and abort or delay rules configured in Istio resources. Istiod only distributes configuration; the actual traffic manipulation happens inside Envoy.

DestinationRule defines traffic policy for a service after routing, and its connectionPool block specifies TCP and HTTP limits such as maxConnections and http1MaxPendingRequests. This satisfies the stem's requirement to configure connection pool settings per service, unlike VirtualService, which handles routing rules rather than pool limits.

maxEjectionPercent caps the share of endpoints that may be ejected from a load-balancing pool. Setting it to 0 permits no endpoints to be removed, so outlier detection effectively stops ejecting hosts and the feature is disabled.

The `maxRequestsPerConnection` field caps how many requests may traverse a single HTTP/1.1 or HTTP/2 connection before Istio closes and reopens it. This satisfies the stem's circuit-breaking constraint by bounding per-connection request volume, forcing periodic connection recycling rather than limiting concurrent requests or retries.

VirtualService fault injection supports a match block, so you can scope the abort or delay to requests carrying specific headers such as a user identifier. Without match, the fault applies to all traffic to that host.

Delay injects a fixed latency into matching requests before they reach the target, using the HTTPFaultInjection delay field with a specified duration. This satisfies the stem's requirement for a valid Istio fault injection type, since Istio supports both delay and abort faults, letting you simulate slow upstream services without altering application code.

The `http` field configures HTTP-specific connection pool limits, namely `http1MaxPendingRequests`, `http2MaxRequests` and `maxRequestsPerConnection`, which govern request-level queuing and reuse. This satisfies the stem's requirement for a `connectionPool` setting, as distinct from TCP-level limits such as `maxConnections` and `connectTimeout`.

Istio applies traffic-shaping rules such as fault injection through VirtualService, which supports an HTTP fault with a fixed delay and a percentage match on the catalog-service host. DestinationRule handles load balancing and connection pools, not request delays.

Istio's HTTPRoute timeout defines the overall deadline for the request as a whole, encompassing all retries. If the 5s global timeout expires while retries are still pending, Envoy terminates the request and returns a timeout to the caller. This is exactly why callers see failures near 5 seconds even when individual retries had not yet been exhausted, since the aggregate budget was consumed.