292 questions total · 4pages · All types, answers revealed
What is the recommended way to test fault injection in a production environment?
This isolates the impact to test traffic, minimizing risk.
Why this answer
Using header-based matching allows you to target faults to specific test traffic without impacting all users.
You want to limit the number of concurrent connections to a service. Which field in the DestinationRule handles this?
connectionPool manages concurrent connections.
Why this answer
The connectionPool field in the trafficPolicy allows setting maxConnections for circuit breaking.
You need to integrate an external database into the mesh that does not support mTLS. How do you configure it securely?
ServiceEntry brings the external service into the registry, and EgressGateway provides a single point of control for policy enforcement.
Why this answer
Use a ServiceEntry to define the external service, and an EgressGateway to handle TLS origination if needed, or simply restrict traffic via an AuthorizationPolicy.
If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?
This is the core evaluation logic in Istio RBAC.
Why this answer
The 'DENY' action takes precedence over 'ALLOW'. If any DENY policy matches, the request is rejected regardless of any ALLOW policy.
Which resource is used to define the root certificate for a custom CA?
This is the specific secret name Istio looks for.
Why this answer
The 'cacerts' secret in the 'istio-system' namespace is used to provide custom root certificates.
Which TWO actions can a VirtualService perform on a request?
Supported.
Why this answer
VirtualServices can rewrite paths and redirect traffic.
In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?
The primary control plane must access the remote cluster's API to manage pods and services.
Why this answer
The secret allows the control plane in the primary cluster to authenticate and access the Kubernetes API of the remote cluster.
You want to ensure that a pod is only ejected if it fails consistently. Which setting is most appropriate?
Increasing both makes the detector less sensitive to transient spikes.
Why this answer
A combination of a longer interval and a higher consecutive error threshold ensures only sustained failures trigger ejection.
How do you define a circuit breaker that trips after 3 consecutive errors?
DestinationRule defines circuit breaking logic.
Why this answer
The outlierDetection field in DestinationRule uses consecutiveGatewayErrors.
To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?
Abort is the correct mechanism for simulating service errors.
Why this answer
The abort fault injection allows specifying a status code and percentage.
Which 'istioctl' command is used to verify that the current Istio configuration in a cluster is valid and follows best practices?
This is the correct command for diagnostic analysis.
Why this answer
The 'istioctl analyze' command inspects the cluster and identifies configuration errors or warnings.
Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?
The client must adapt to the server's requirement.
Why this answer
STRICT mode forces mTLS, causes the proxy to reject plain text, and mandates that both client and server sidecars perform the handshake.
You observe that your sidecars are crashing due to 'Out of Memory' (OOM). What is a likely configuration error?
Without scoping, the sidecar downloads configuration for every service, which can exceed memory limits in large meshes.
Why this answer
Over-subscribing sidecars with too many services or complex routing rules (like large numbers of VirtualServices) can lead to high memory consumption in the sidecar proxy.
What is the correct syntax for a principal in an AuthorizationPolicy?
Matches the SPIFFE URI format.
Why this answer
The principal follows the SPIFFE ID format: 'cluster.local/ns/default/sa/my-service'.
How do you ensure that a workload ignores a global PeerAuthentication policy?
Selectors allow granular overrides.
Why this answer
A workload-specific PeerAuthentication policy (with a selector) will override a global (namespace or root) policy.
When using 'maxRequests' in connectionPool, what happens when the threshold is reached?
When the connection pool is full, new requests are rejected immediately.
Why this answer
In Envoy, maxRequests is a circuit-breaking limit that rejects new requests with a 503 error when the limit is exceeded.
Which command is used to view the current Istio configuration resources in a namespace?
kubectl get lists resources.
Why this answer
kubectl get is the standard tool to list Kubernetes resources, including Istio CRDs.
Which of the following are valid DestinationRule fields? (Choose THREE)
Valid field.
Why this answer
DestinationRule includes host, trafficPolicy, and subsets.
What is the primary purpose of adding a timeout to a service call?
By failing fast, you release resources and prevent cascading failure.
Why this answer
Timeouts prevent resources from being held indefinitely by slow or hung services.
You want to perform a 'headers' modification on an incoming request. Which resource allows this?
VirtualService has a headers field for mutations.
Why this answer
VirtualService allows header manipulation (add, remove, replace) in the route action.
To strip a URL prefix before passing a request to a backend service, which field do you use?
Rewrite modifies the path.
Why this answer
The rewrite field in a VirtualService can modify the URI path.
When a request fails, where can you check the reason for the failure in the Istio ecosystem?
Kiali is the visualization and observability tool.
Why this answer
Kiali provides visual traffic flow analysis and error code identification.
When multiple AuthorizationPolicies target the same workload, how are they combined?
Multiple ALLOW policies are combined so that if any match, access is granted.
Why this answer
If multiple policies are applied to the same workload, they are evaluated using an additive approach (OR logic) for ALLOW policies within the same namespace.
Which TWO conditions can trigger Outlier Detection ejection?
Standard error trigger.
Why this answer
Outlier detection uses both consecutive 5xx errors and consecutive gateway failures.
Which TWO settings in a DestinationRule are used for load balancing?
Defines the simple load balancing algorithm (e.g., ROUND_ROBIN).
Why this answer
TrafficPolicy includes the load balancing settings for a service.
Which are valid match conditions in VirtualService? (Choose THREE)
Valid match.
Why this answer
Match conditions include headers, uri, and port.
Which of these are valid load balancer algorithms in DestinationRule? (Choose TWO)
Valid algorithm.
Why this answer
ROUND_ROBIN and LEAST_CONN are valid load balancer settings in Istio.
Which TWO parameters are used to define a 'match' criteria in a VirtualService?
Valid match condition.
Why this answer
Headers and authority (or URI) are valid match conditions.
When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?
This is the standard Envoy metric for upstream request timeouts.
Why this answer
This metric indicates the number of requests that timed out while waiting for a response from the upstream service.
Which THREE of the following are valid ways to control egress traffic in Istio?
Limits the services visible to the sidecar.
Why this answer
Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.
How do you implement a circuit breaker to eject a pod that returns 5xx errors?
OutlierDetection is the mechanism for ejecting unhealthy hosts.
Why this answer
OutlierDetection within the DestinationRule manages circuit breaking by ejecting unhealthy instances.
What are valid fields in the VirtualService 'http' route? (Choose TWO)
Valid field.
Why this answer
VirtualService route blocks use 'route' and 'match'.
You want to access an external API (e.g., api.google.com) from within your mesh. What must you configure?
ServiceEntry registers external hosts.
Why this answer
ServiceEntry allows adding entries to the Istio internal service registry for external endpoints.
You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?
Namespaced policy has precedence over global.
Why this answer
Namespaced policies override global ones within that namespace. A policy with no selector applies to all workloads in that namespace.
You are testing resilience. You want to inject an HTTP 503 error for 20% of traffic to the 'catalog' service. Which fault setting is correct?
Correct structure for abort fault injection.
Why this answer
The fault injection abort policy requires an HTTP status code and a percentage.
A service is returning 5xx errors frequently. You want to eject instances that return 5 consecutive 5xx errors. Which OutlierDetection setting is required?
This accurately defines the threshold for consecutive 5xx responses before ejection.
Why this answer
consecutive5xx is the field used to trigger ejection based on the count of 5xx errors.
You need to inspect the envoy config for a specific pod. Which command do you use?
proxy-config all shows full proxy state.
Why this answer
istioctl proxy-config all <pod-name> shows all configuration for that proxy.
Which THREE are types of traffic management patterns?
Supported pattern.
Why this answer
Canary deployments, traffic mirroring, and circuit breaking are all core Istio patterns.
Which THREE conditions must be met for a PeerAuthentication policy to enforce STRICT mTLS?
The proxy must be present.
Why this answer
STRICT mode requires an Istio-enabled sidecar, the PeerAuthentication mode set to STRICT, and the absence of conflicting policies.
Which field defines how long an ejected pod remains out of the rotation?
This field specifies the length of the ejection period.
Why this answer
baseEjectionTime determines the duration an instance is excluded from the load balancing pool.
Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?
This tells Istio how to validate the JWT.
Why this answer
To use JWT, you must define a RequestAuthentication policy, ensure the workload accepts the token, and use an AuthorizationPolicy to enforce 'DENY' or 'ALLOW' based on claims.
Which of the following are valid traffic management components in Istio? (Choose TWO)
Valid component.
Why this answer
VirtualService and DestinationRule are the core traffic management resources.
What protocol does the Gateway resource support?
Gateways are protocol-agnostic for the defined ports.
Which TWO Istio components can be configured via the 'spec.components' section in IstioOperator?
Istiod is a core component.
Why this answer
Both 'pilot' (the core control plane) and 'ingressGateways' are core components configurable under 'spec.components'.
Which TWO of the following are valid connectionPool fields?
Defines TCP pooling.
Which resource is used to provide a unified entry point for multiple services?
Gateway is the standard ingress controller.
Why this answer
A Gateway resource, when combined with a VirtualService, provides a single ingress point.
Which TWO of the following are true regarding PeerAuthentication policies?
Global policy requires root namespace deployment.
Why this answer
They can be applied at mesh, namespace, or workload level, and the mode can be STRICT or PERMISSIVE.
When planning an Istio upgrade, which THREE steps are critical for a canary upgrade strategy?
Required for parallel control planes.
Why this answer
Canary upgrades require installing a new revision, updating the namespace label, and then performing a rolling restart of the application pods.
You want to allow traffic only from a specific namespace 'prod' to the 'backend' service. How should you define the 'AuthorizationPolicy'?
This correctly filters requests originating from the prod namespace.
Why this answer
AuthorizationPolicy uses the 'source' field to restrict traffic by namespace using the 'namespaces' attribute.
Which THREE items can you configure in a VirtualService to improve resilience?
Handles transient failures.
Why this answer
Timeouts, Retries, and Fault Injection are all controlled within a VirtualService.
You need to ensure that traffic is only routed to healthy pods. What feature does this?
Outlier detection tracks and ejects unhealthy hosts.
Why this answer
Outlier detection in DestinationRule ejects unhealthy hosts from the load balancing pool.
How do you specify a header-based match in a VirtualService?
Match conditions are defined in the match block of the route.
Why this answer
The 'match' field allows conditions like 'headers' to be evaluated.
Which TWO of the following are true regarding the RequestAuthentication resource?
Selectors allow granular policy targeting.
Why this answer
RequestAuthentication is used to validate JWTs and can be applied at the namespace or workload level.
Which THREE settings are required in a VirtualService for a canary deployment?
Routes define the destination subsets.
What does the 'jwksUri' field in a RequestAuthentication resource define?
This is the definition of a JWKS URI.
Why this answer
The jwksUri specifies the endpoint where the JWT issuer publishes its public keys, used by Istio to verify the token signature.
When configuring a Gateway API resource, which TWO properties are defined within the 'listeners' block?
Defines which port the gateway listens on.
Why this answer
Listeners define the protocol, port, and hostname bindings for the gateway.
What is the function of the 'weight' parameter in a VirtualService route?
Weight defines the traffic distribution percentage.
Why this answer
Weight determines the percentage of traffic directed to a specific destination.
You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?
Kiali uses color coding to visualize health status; red indicates failures or policy rejections.
Why this answer
In Kiali, a red line indicates that traffic is failing or being rejected by an Istio policy.
Which THREE actions occur when you label a namespace with 'istio-injection=enabled'?
This is the primary function.
Why this answer
The webhook controller is notified, existing pods are not affected, but new pods will have the sidecar injected automatically.
You want to limit the total number of concurrent connections to a service. Where is this defined?
connectionPool handles connection limits.
Why this answer
connectionPool settings in the DestinationRule control connection limits.
Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?
If 'source.principal' is present, the connection is authenticated via mTLS.
Why this answer
The 'source.principal' attribute is only populated if the connection is authenticated via mTLS, making it a reliable way to verify mTLS use.
Which of these are valid sub-commands for istioctl? (Choose TWO)
Valid command.
Why this answer
istioctl analyze and istioctl proxy-config are valid commands.
Which THREE things happen when a request fails and a retry policy is active?
Validates if the retry is allowed.
Why this answer
The sidecar checks the retry condition, waits for the backoff, and attempts the request again until the limit.
Which THREE of the following are valid fields in a 'retry' policy?
Timeout for each retry.
Why this answer
attempts, perTryTimeout, and retryOn are common retry policy fields.
How do you define a regex match in a VirtualService?
Standard field for regex.
Why this answer
The match block URI uses the 'regex' field for pattern matching.
Which parameters can be configured in a VirtualService retry policy? (Choose TWO)
Valid parameter.
Why this answer
attempts and perTryTimeout are the primary fields for retry policies.
What is the purpose of the 'PILOT_ENABLE_MTLS_OVERRIDE' environment variable in istiod?
This was historically used to provide granular control before mature AuthorizationPolicies were available.
Why this answer
This is a deprecated or legacy setting, but in specific contexts, it was used to allow sidecars to override global mTLS settings, though modern versions prefer AuthorizationPolicies.
You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?
Setting the mode to STRICT ensures that only mTLS traffic is accepted.
Why this answer
A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.
What does an AuthorizationPolicy's 'operation' field represent?
Used for layer 7 traffic control.
Why this answer
The operation field defines the methods (GET, POST) and paths allowed or denied.
What are the primary ways to limit traffic to a service? (Choose TWO)
Routing.
Why this answer
You can use VirtualService (for routing) and DestinationRule (for circuit breaking/load balancing).
Which THREE items are required to successfully authenticate a user via JWT in Istio?
Optional but highly recommended for security.
Why this answer
You need the issuer URL, the JWKS URI, and the audience to validate the JWT correctly.
Which component in Istio is responsible for collecting telemetry data and sending it to observability tools like Prometheus?
The Telemetry resource in Istio manages metrics and tracing collection.
Why this answer
The Istio Telemetry component, often integrated into the sidecar and processed by the Istio control plane, handles data collection.
When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?
The sidecar directly queries the JWKS endpoint.
Why this answer
The sidecar automatically fetches the JWKS from the URL defined in the 'jwksUri' field within the RequestAuthentication policy.
An application is experiencing intermittent errors. You decide to use outlier detection to eject unhealthy pods. Which field in the DestinationRule controls the ejection of hosts after a certain number of 5xx errors?
This is the correct field for triggering host ejection based on error counts.
Why this answer
The 'consecutive5xxErrors' field in the 'outlierDetection' section of a DestinationRule is used to eject unhealthy hosts.
In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?
All clusters must trust the same root CA to validate identities across cluster boundaries.
Why this answer
For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.
Practice ICA by domain
Target a specific domain to shore up weak areas.