CKA Service Mesh Basics 2 — Questions and Answers
Question 1: In Istio, which component is responsible for distributing configuration to all Envoy proxies in the mesh?
- Pilot (Correct answer)
- Citadel
- Galley
- Mixer
Correct answer: Pilot
Istio Pilot (now part of istiod) translates high-level routing rules into Envoy-specific configuration and pushes it to all sidecar proxies.
Question 2: Which Kubernetes resource does Istio use to define traffic routing rules such as weight-based canary splits?
- VirtualService (Correct answer)
- DestinationRule
- Gateway
- ServiceEntry
Correct answer: VirtualService
VirtualService defines how requests are routed to a service, including traffic splitting, retries, and fault injection.
Question 3: What is the primary purpose of a DestinationRule in Istio?
- Define policies applied after routing, such as load balancing and TLS settings (Correct answer)
- Expose services outside the mesh via an ingress point
- Register external services within the mesh
- Set up mutual TLS between control-plane components
Correct answer: Define policies applied after routing, such as load balancing and TLS settings
DestinationRule configures post-routing policies like connection pooling, outlier detection, and TLS mode for a destination service.
Question 4: In a service mesh, what does mTLS stand for and what problem does it solve?
- Mutual TLS; it ensures both client and server authenticate each other (Correct answer)
- Managed TLS; it automates certificate renewal only
- Multi-Tenant TLS; it isolates tenant traffic
- Mesh TLS; it encrypts control-plane communication only
Correct answer: Mutual TLS; it ensures both client and server authenticate each other
Mutual TLS requires both the client and server to present certificates, enabling two-way authentication and encrypted communication.
Question 5: Which Istio resource would you use to expose an HTTP service running inside the mesh to external clients?
- Gateway (Correct answer)
- VirtualService
- ServiceEntry
- PeerAuthentication
Correct answer: Gateway
An Istio Gateway configures a load balancer at the edge of the mesh to handle incoming or outgoing connections from external traffic.
Question 6: What happens to a pod's network traffic when an Envoy sidecar is injected?
- All inbound and outbound traffic is transparently redirected through the Envoy proxy via iptables rules (Correct answer)
- Only outbound traffic is proxied; inbound traffic bypasses Envoy
- Traffic is proxied only when explicitly configured in the application code
- The pod must restart and re-register with Pilot to activate proxying
Correct answer: All inbound and outbound traffic is transparently redirected through the Envoy proxy via iptables rules
Istio uses iptables rules (configured by the istio-init container) to redirect all pod traffic through the Envoy sidecar transparently.
Question 7: Which annotation enables automatic Envoy sidecar injection for all pods in a namespace?
- istio-injection=enabled on the namespace (Correct answer)
- sidecar.istio.io/inject=true on each pod
- istio.io/proxy=auto on the namespace
- inject.istio.io=enabled on each deployment
Correct answer: istio-injection=enabled on the namespace
Labeling a namespace with istio-injection=enabled causes the Istio admission webhook to automatically inject the Envoy sidecar into new pods.
CKA Service Mesh Basics 2
In Istio, which component is responsible for distributing configuration to all Envoy proxies in the mesh?