CCNA Traffic Management Questions

ServiceEntry registers the external database host in the mesh registry, while DestinationRule defines the TLS origination policy for that host. Together they satisfy the stem's constraint: enabling mesh egress to an external database over TLS.

The Gateway's TLS section configures SNI-based routing by matching the server name presented during the TLS handshake to a credentialName, directing traffic to the appropriate hosts. Without it, the gateway cannot distinguish virtual hosts on shared ports.

Mismatched subset labels between DestinationRule and VirtualService cause routing failures, since the VirtualService references a subset name that the DestinationRule must define against matching pod labels. Verifying these align resolves the common misconfiguration where traffic silently falls back or fails, satisfying the stem's requirement to correct faulty routing.

http2MaxRequests limits concurrent streams per connection and maxRequestsPerConnection forces a connection to be recycled after a set number of requests, which together govern HTTP/2 connection reuse and capacity. Setting these values is how operators tune multiplexing and connection lifecycle at the pool level. This satisfies the connection reuse requirement while the outlier detection block handles ejection.

DestinationRule configures mTLS for traffic to a service by setting the TLS mode within its trafficPolicy, satisfying the requirement to control mutual authentication between sidecars. It governs the client side of a connection, enforcing STRICT or PERMISSIVE modes, which is why it is one of the two resources that manage mTLS settings.

TCP is the correct protocol value for a ServiceEntry describing a raw TCP service, since Istio then applies TCP-level routing and load balancing rather than HTTP inspection. It satisfies the stem's constraint of matching the service's actual transport.

The istio-proxy sidecar intercepts inbound and outbound pod traffic via iptables redirection, enabling Envoy to apply mTLS, routing and telemetry without application changes. This satisfies the stem's requirement for the container's primary function: transparent traffic interception at the pod network layer.

Mirroring sends a duplicate of live production traffic to the new service version while the primary still serves real responses, letting you test the new version under genuine load without impacting users. This matches the requirement precisely.

ROUND_ROBIN is Istio's default load balancing policy when a DestinationRule omits the field, distributing requests sequentially across healthy endpoints in each subset. This satisfies the stem's constraint of no explicitly specified policy, so traffic spreads evenly without requiring any additional configuration.

A VirtualService binds routing rules to the Gateway, matching hosts and directing inbound traffic to mesh services. Without it, the Gateway accepts connections but has no routes, so external traffic cannot reach workloads. Both components together satisfy the requirement for external ingress.

The retryOn field lists the conditions, such as connect-failure, reset or gateway-error, that trigger Istio to retry a failed request to the destination. It defines when retries occur, while attempts and perTryTimeout govern how many and how long.

A Gateway configures the ingress listener at the mesh edge, defining ports, hosts and TLS for incoming external traffic. It satisfies the stem's requirement to expose a service outside the mesh, with a VirtualService binding routes to it.

The istio-system namespace hosts Istio's control plane components, including istiod, which handles service discovery, configuration distribution, and certificate management. It is not where application workloads or data-plane sidecars run, so it satisfies the requirement for a dedicated namespace isolating control plane functions.

Hostnames a Gateway should accept are defined in the Gateway's own listener configuration, where each listener specifies its hostname and certificate binding. Configuring them here satisfies the stem's requirement directly, since the Gateway resource itself holds the accepted-hostname settings rather than a separate policy or DNS record.

istioctl analyze inspects the cluster's Istio configuration resources and reports errors, warnings and misconfigurations, such as invalid virtual services or conflicting gateways. It directly satisfies the requirement to troubleshoot configuration issues by analysing the cluster for errors.

Connection pooling is configured through the connectionPool settings within trafficPolicy, letting you cap HTTP/1.1 pending requests, HTTP/2 concurrent streams, and TCP connections per host. This satisfies the stem's requirement for a supported trafficPolicy feature, as these limits are applied to individual destination hosts.

Istio's VirtualService defines traffic routing rules, including weighted destinations that split requests between subsets. Specifying a 90/10 weight distribution across two versions achieves the canary rollout, which no other Istio resource exposes as a routing control.

PeerAuthentication defines the mTLS mode for workloads on the receiving side, so verifying it confirms traffic is encrypted. Its mtls mode enforces mutual TLS between sidecars, satisfying the requirement that service traffic is encrypted via mTLS.

Load balancer policy directly governs how incoming connections are spread across backend pods, satisfying the requirement for a traffic-distribution configuration. In Kubernetes, the Service's `externalTrafficPolicy` and `internalTrafficPolicy` settings determine whether traffic is routed to all endpoints cluster-wide or only to pods on the receiving node, altering distribution behaviour.

RANDOM is a valid Istio load balancing policy, distributing requests across healthy endpoints without weighting. It satisfies the question's requirement for a genuine Istio policy, alongside ROUND_ROBIN and LEAST_REQUEST. Istio also offers PASSTHROUGH and consistent hash-based options, but RANDOM remains a core supported policy.

A VirtualService can route requests, matching on host, path, headers or other attributes and directing traffic to destination subsets or versions. Routing is one of its core request-handling actions, satisfying the question's requirement alongside fault injection, redirects and rewrites.

kubectl get virtualservices queries the Kubernetes API for VirtualService custom resources in the active namespace, listing them in a table. It satisfies the listing requirement because VirtualServices are Kubernetes CRDs, so kubectl, not istioctl, performs namespace-scoped resource enumeration.

The `connectionPool` field in a DestinationRule defines TCP and HTTP connection limits, including `maxConnections` and `http1MaxPendingRequests`, which cap concurrent connections to the service. This directly satisfies the requirement to limit concurrent connections, unlike traffic policy fields governing load balancing or outlier detection.

VirtualService traffic routing rules can rewrite the request URI before forwarding, altering the path or host the destination workload receives. This is distinct from header manipulation or retries, which are separate actions within the same routing configuration.

`host` is a required DestinationRule field, specifying the destination service's fully qualified domain name or short name that traffic policies apply to. It satisfies the stem's demand for valid DestinationRule fields, since every DestinationRule must declare which service it governs before defining subsets, load-balancing or connection-pool settings.

VirtualService HTTP route rules expose a headers field supporting request and response manipulation, including set, add and remove operations. This is the only Istio resource that rewrites incoming request headers before forwarding to the destination.

The rewrite field strips or replaces a matched URL prefix before forwarding the request upstream, so the backend receives the path it expects. This satisfies the requirement to remove the prefix without altering the client-facing route.

Headers match on HTTP request header values, satisfying the stem's requirement for valid VirtualService match conditions. Istio evaluates them alongside URI, method, and source labels within the match block, enabling routing decisions based on custom or standard headers such as authorisation tokens or content type.

DestinationRule outlierDetection continuously analyses each endpoint's 5xx responses and ejects the offending pod from the load-balancing pool once consecutive failures breach the configured threshold, satisfying the requirement to remove misbehaving pods automatically. Istio's Envoy sidecars enforce this at the data plane, so no application code changes are needed.

ServiceEntry registers external hosts in Istio's internal service registry, letting mesh sidecars resolve and route to api.google.com. Without it, the sidecar's outbound traffic policy blocks unknown external destinations, so this satisfies the requirement to reach an external API.

`istioctl proxy-config all` dumps every Envoy configuration category — clusters, listeners, routes, endpoints and secrets — for the named pod's sidecar, satisfying the requirement to inspect the full envoy config. Unlike narrower subcommands such as `cluster` or `listener`, `all` returns the complete configuration in one pass.

Canary deployment is a traffic management pattern that shifts a small percentage of live traffic to a new version, then gradually increases it. This progressive rollout limits blast radius, matching the question's requirement for a recognised traffic management pattern.

VirtualService defines how requests are routed to a service within Istio's traffic management API, specifying matching rules and destinations. It is a core traffic management component, satisfying the question's requirement for valid Istio traffic management resources.

The Kubernetes Gateway resource models Layer 4 and Layer 7 routing, so listeners can be configured for HTTP, HTTPS, GRPC and TCP traffic. This protocol set satisfies the requirement to expose both web and raw TCP services through one gateway.

A gateway consolidates access to several backend services behind one address, giving clients a single, unified entry point rather than separate endpoints. It satisfies the stem's requirement for one entry point by routing and translating requests to the appropriate service, unlike a proxy that typically forwards to a single destination.

DestinationRule outlierDetection continuously ejects pods that return consecutive 5xx errors or fail health checks, removing them from the load-balancing pool so traffic reaches only healthy endpoints. This directly satisfies the stem's requirement to route traffic exclusively to healthy pods, unlike liveness probes, which merely restart containers without influencing routing decisions.

Header-based matching is expressed inside the match block of an HTTP route, using a headers list with exact, prefix or regex matchers. This satisfies routing decisions based on request headers rather than URI or method alone.

The http routes block is mandatory: it defines the match conditions and destination subsets that split traffic between stable and canary versions. Without it, the VirtualService has no routing rules to weight, so canary splitting cannot occur.

Weight assigns a relative proportion of traffic to each destination within a single route block, letting you split requests across multiple subsets or hosts. This satisfies the stem's requirement by distributing load between several destinations rather than sending all traffic to one.

DestinationRule defines connection pool limits under its trafficPolicy, using tcp.maxConnections to cap concurrent TCP connections to a service. This directly satisfies the stem's requirement to limit total concurrent connections, since the setting is enforced per destination host by Envoy sidecars.

The analyze sub-command inspects a live cluster or configuration files for misconfigurations, reporting warnings and errors. It validates Istio resources against best practise, making it a genuine istioctl sub-command used for diagnosing broken mesh configuration.

The `attempts` parameter sets how many times Envoy re-tries a failed request before returning an error to the caller, satisfying the stem's requirement for configurable retry-policy parameters. Istio's VirtualService retry block exposes `attempts` alongside `perTryTimeout` and `retryOn`, so it is directly configurable.

Gateway references in a VirtualService are resolved as '<namespace>/<name>' when the Gateway lives in a different namespace than the VirtualService. Because payments-vs is in 'prod' and payments-gw is in 'istio-system', the short name only resolves within the VirtualService's own namespace, so the Gateway never binds the route and clients receive 404. Qualifying the reference with the Gateway's namespace binds the route correctly.

Istio infers the protocol for a Service port from the port name prefix (http-, tcp-, grpc-, etc.), so naming 8080 http-api and 9090 tcp-admin makes the sidecar apply HTTP parsing to one and opaque TCP handling to the other. This is the standard, supported way to declare per-port protocol on a Kubernetes Service without extra configuration.

"Servers" is a valid Gateway configuration because Istio's ingress gateway can run directly on bare-metal or virtual machines, not only as a Kubernetes pod. This satisfies the stem's requirement for valid deployment targets, since the gateway workload may be hosted on standalone servers outside a cluster.

consistentHash hashes a chosen request attribute, such as a cookie or source IP, so the same user consistently maps to the same pod, satisfying the requirement that requests from one user always reach the same pod.

A VirtualService defines the routing rules that distribute requests across versioned workloads, satisfying the requirement to split traffic between versions. It matches on hosts, paths and headers, then weights destinations to specific subsets, so percentage-based canary or blue-green distribution becomes possible when paired with a DestinationRule.

istioctl proxy-config routes queries the Envoy admin API and prints the route configuration currently loaded in a specific sidecar. This satisfies the constraint of verifying actual routes, revealing whether the VirtualService changes were pushed and how they were translated.

VirtualService supports fault injection, including a fixed delay applied to matching requests. Specifying a five-second delay in the http fault block makes Envoy hold each matching request, satisfying the testing requirement without changing application code.

The `trafficPolicy` block accepts `loadBalancer`, which configures how Istio distributes requests across a service's endpoints — for example `ROUND_ROBIN`, `LEAST_REQUEST` or `RANDOM`. This satisfies the stem's requirement for a genuine trafficPolicy field, since load balancing policy is defined there rather than in the DestinationRule's top-level spec.

The Gateway resource's servers block declares the hosts, port and TLS settings the ingress or egress proxy listens on. This satisfies the stem directly: host definitions belong to the Gateway, while routing rules referencing that gateway live in the VirtualService.

Istio's VirtualService defines routing rules, including weighted destination subsets, so you can direct a percentage of traffic to the canary version and the remainder to the stable one. DestinationRule merely defines those subsets; the VirtualService performs the actual traffic split.

The subset's label selector lives in the DestinationRule spec, under subsets[].labels. If those labels do not match the pod labels, no endpoints populate the subset and traffic fails, so that is where the match must be verified.

VirtualService HTTP route match rules support URI path conditions, directing requests to distinct destinations based on the URL path. This path-based routing capability is exactly what the scenario requires, unlike DestinationRule, which handles subsets and policies after routing is decided.

PeerAuthentication enforces mutual TLS between workloads in the Istio mesh, satisfying the requirement for an mTLS policy resource. Its mtls mode setting (STRICT, PERMISSIVE or DISABLE) controls whether sidecar proxies accept only encrypted, certificate-authenticated connections, directly configuring transport-level authentication rather than authorisation or routing.

The match field within an HTTP route accepts header criteria, letting you specify exact, prefix or regex matches on a named header. This satisfies the stem's requirement for defining custom header matching in a VirtualService.

The fault field injects delays or aborts into a percentage of requests at the Envoy proxy, directly satisfying the resilience-testing requirement without touching application code. Other VirtualService fields handle routing, retries and mirroring, but only fault deliberately corrupts traffic.

A VirtualService match inspects HTTP headers directly, so an exact or regex match on `x-user-type` routes requests to the appropriate destination. This satisfies the stem's requirement to route by that header, unlike host- or path-based rules, which cannot discriminate on arbitrary request headers.

A ServiceEntry adds the external dependency to Istio's internal service registry, giving mesh sidecars the DNS name, endpoints and ports needed to route traffic to it. This directly satisfies the stem's constraint: the dependency is absent from the Kubernetes registry, so mesh services cannot otherwise resolve or reach it.

kubectl get pods lists every pod in the namespace, and because each sidecar-injected pod appears as a single pod with its proxy container, this command shows all pods including proxies. It satisfies the stem's requirement to view status across pods and their injected proxies.

ServiceEntry adds external endpoints to Istio's internal registry, letting sidecars route to a service outside the mesh. It satisfies the stem's constraint of defining a local service absent from the cluster: the entry registers the hostname, address and ports, so Envoy treats the external destination as mesh-local.

Weighted routing in a VirtualService http.route block splits traffic across destinations by percentage, and the weights must sum to 100. Setting 90 and 10 sends nine-tenths to stable and one-tenth to the canary, exactly matching the requested canary split. This is the canonical Istio pattern for progressive delivery and integrates with the named subsets from the DestinationRule.

The VirtualService destination block uses the subset field to name a subset declared in the corresponding DestinationRule, restricting routing to those labelled pods. This satisfies the constraint of limiting traffic to a specific subset rather than the whole service.

The `interval` setting defines how frequently the outlier detection engine evaluates each backend, expressed as a duration. It satisfies the stem's requirement for a setting configured inside the `outlierDetection` block, controlling the evaluation cadence that determines when unhealthy hosts are ejected from the load-balancing pool.

The mirror field in a VirtualService duplicates live traffic to a shadow destination while the primary response is returned to the caller. This satisfies traffic shadowing, letting you test a new version with real requests without affecting production responses.

The redirect field in an HTTP route rewrites the request to a different URI or authority, returning a 301 by default. This satisfies the stem's path-redirection requirement, unlike rewrite, which forwards to the destination while altering the path.

The weight field under an HTTP route destination splits traffic proportionally between subsets, so assigning unequal weights (for example 90/10) sends a controlled share to a canary version. This satisfies the A/B testing requirement by enabling gradual, measurable traffic distribution across versions.

PeerAuthentication is the mesh-wide resource governing how sidecars receive and require mTLS. Applying one in the root namespace without a selector sets the mesh-wide default to STRICT, enforcing mutual TLS for every workload in the cluster.

The clusters subcommand lists the upstream clusters Envoy knows about, showing the services and subsets the proxy can route to. This reveals the proxy's configured backends, which is one of the three information types requested.

Downloading the istioctl binary directly from the Istio release page places the CLI on the local machine, which is the documented standard installation method. Package managers and Helm charts install the control plane, not the istioctl client tool itself.

`perTryTimeout` caps the duration of each individual retry attempt, satisfying the stem's requirement for a single-attempt limit. It differs from `timeout`, which bounds the entire request lifecycle including all retries. Setting `perTryTimeout` ensures a slow attempt is abandoned before consuming the overall VirtualService deadline.

Gateway configures a standalone Envoy at the mesh edge, opening the listener ports and hosts that admit external traffic. This satisfies the constraint of defining the entry point, since inbound requests must match the Gateway's servers before a VirtualService can bind and route them.

Envoy sidecars and gateways intercept every request and apply the pushed listener, route and filter rules, including mTLS and authorization checks. This satisfies the constraint because policy enforcement occurs at the proxy, not in istiod, which only distributes configuration.

The subset field selects a named subset of a destination's endpoints, defined by labels such as version, so traffic routes only to pods matching that label set. This enables version-specific or canary routing within Istio VirtualService destinations.

DestinationRule defines named subsets by matching pod labels, so header-based routing in the VirtualService can reference a specific version. The subset itself lives in the DestinationRule; the VirtualService only selects it, satisfying the requirement to route by header to one version.