Hard Difficulty Questions

Run a sidecar on the database server.

Why wrong: Installing Istio components on external databases is not standard practice.

Enable 'PERMISSIVE' mTLS mode for the entire mesh.

Why wrong: This weakens security across the entire mesh.

Create a Kubernetes Service with the database IP.

Why wrong: Standard K8s services do not integrate with Istio's egress control features.

maxRequestsInQueue

Why wrong: Not the correct field name.

maxPending

Why wrong: Not the correct field name.

pendingRequestsLimit

Why wrong: Not the correct field name.

maxPendingRequests

Why wrong: Not the correct field name.

action

Why wrong: Action is a top-level field, not part of the rules array.

selector

Why wrong: Selector defines which workloads the policy applies to, not the rules themselves.

Kiali Dashboard

Why wrong: Kiali is for visualization, not traffic control.

PeerAuthentication

Why wrong: Only handles internal authentication.

A ServiceEntry with 'resolution: DNS'.

Why wrong: ServiceEntry handles routing and discovery, not identity and trust.

An AuthorizationPolicy allowing all traffic.

Why wrong: This affects authorization, not the trust domain required for mTLS encryption.

An EgressGateway with TLS origination.

Why wrong: EgressGateway is for traffic exiting the mesh to external services, not for inter-cluster traffic.

EnvoyFilter for mTLS

Why wrong: DestinationRule is the preferred way for TLS config.

AuthorizationPolicy

Why wrong: AuthorizationPolicy is not required for egress TLS.

It only works with TCP services.

Why wrong: Works with HTTP and GRPC as well.

It can be configured in a VirtualService.

Why wrong: It must be in a DestinationRule.

It is used to rate limit traffic.

Why wrong: That is a circuit breaker function.

It requires an external monitoring tool.

Why wrong: It is handled by the data plane proxy.

All non-Istio traffic is automatically routed to the gateway.

Why wrong: Traffic is simply dropped if it doesn't match the TLS handshake.

The proxy automatically upgrades HTTP to HTTPS.

Why wrong: mTLS is layer 4; it does not change layer 7 protocol.

Local sidecar memory limits

Why wrong: Memory limits are for stability, not observability.

VirtualService timeouts

Why wrong: Timeouts relate to traffic management, not observability.

The 'tcp-metadata' filter.

Why wrong: This filter adds metadata and is not typically associated with data buffering.

The 'outlier-detection' settings.

Why wrong: Outlier detection focuses on removing unhealthy hosts.

The 'circuit-breaker' settings.

Why wrong: Circuit breaking limits concurrency but does not buffer data.

It is ejected for 1 second

Why wrong: 1s is the monitoring interval, not the ejection time.

It is removed permanently

Why wrong: Ejection is temporary, not permanent.

It is ignored because the interval is too small

Why wrong: The interval is valid for outlier detection.

Disabling mTLS for performance

Why wrong: Disabling mTLS is a security risk and not an HA strategy.

Using a single ingress gateway for all traffic

Why wrong: This creates a single point of failure.

The ingress gateway has too many listeners.

Why wrong: Gateways are separate from sidecars; this wouldn't OOM the sidecar.

The Kubernetes node is under-provisioned.

Why wrong: While possible, the most likely Istio-specific cause is the scope of service discovery.

The MTU size is too small.

Why wrong: MTU affects packet fragmentation, not proxy memory.

Kiali visualization plugin

Why wrong: Kiali is optional and for observability.

External DNS provider

Why wrong: While helpful, it is not strictly required for the base multi-cluster configuration.

Automatic certificate management

Why wrong: Still requires external tools like Cert-Manager.

Direct integration with Prometheus

Why wrong: This is not a feature of the API itself.

headers

Why wrong: Headers are optional for filtering, not required for the fault itself.

match

Why wrong: Matches are for routing selection, not defining the fault behavior itself.

fixedDelay

Why wrong: This is for delay injection, not abort.

Decrease interval, decrease consecutive5xx.

Why wrong: This makes the system highly sensitive to any error.

Decrease interval, increase consecutive5xx.

Why wrong: Decreasing the interval makes it scan more often, potentially increasing sensitivity.

Disable outlierDetection and use only circuitBreaking.

Why wrong: Circuit breaking works differently than outlier detection.

Increase interval, decrease consecutive5xx.

Why wrong: Decreasing the threshold makes it easier to eject pods.

trafficPolicy.outlierDetection.maxRequests

Why wrong: Outlier detection does not contain this field.

trafficPolicy.connectionPool.http.http2MaxRequests

Why wrong: This is specific to HTTP/2.

trafficPolicy.circuitBreaker.maxRequests

Why wrong: CircuitBreaker object does not contain maxRequests.

trafficPolicy.connectionPool.tcp.maxConnections

Why wrong: This limits TCP connections, not request concurrency.

grpc

Why wrong: Not a direct field in connectionPool.

tls

Why wrong: TLS is a separate field within trafficPolicy.

Use the 'principals' field.

Why wrong: Principals are for identity, not custom claims.

Use the 'from' field in the 'source' object.

Why wrong: The 'from' field is not used for claims.

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.

Why wrong: AuthorizationPolicy natively supports claim validation.