CKA Service Mesh Basics 3 — Questions and Answers
Question 1: Which Istio resource is used to register and control traffic to external services (outside the mesh)?
- ServiceEntry (Correct answer)
- Gateway
- DestinationRule
- VirtualService
Correct answer: ServiceEntry
ServiceEntry adds external services to Istio's internal service registry, allowing mesh-wide policies and traffic management to apply.
Question 2: In Istio, what is the purpose of PeerAuthentication?
- Configure mTLS mode between workloads in the mesh (Correct answer)
- Define which external peers can access the ingress gateway
- Set JWT authentication requirements for end-user requests
- Control which pods can communicate using network policies
Correct answer: Configure mTLS mode between workloads in the mesh
PeerAuthentication defines how traffic is tunneled, specifying whether mTLS is STRICT, PERMISSIVE, or DISABLED for service-to-service communication.
Question 3: What is the difference between STRICT and PERMISSIVE mTLS mode in Istio?
- STRICT requires mTLS for all connections; PERMISSIVE accepts both plaintext and mTLS (Correct answer)
- STRICT allows only plaintext; PERMISSIVE requires mTLS for all
- STRICT encrypts control-plane only; PERMISSIVE encrypts data-plane only
- STRICT disables mTLS; PERMISSIVE enables it selectively
Correct answer: STRICT requires mTLS for all connections; PERMISSIVE accepts both plaintext and mTLS
In STRICT mode every connection must use mTLS, while PERMISSIVE mode allows both mTLS and plaintext to ease migration of legacy services.
Question 4: Which Istio resource is used to define end-user (JWT) authentication policies?
- RequestAuthentication (Correct answer)
- PeerAuthentication
- AuthorizationPolicy
- DestinationRule
Correct answer: RequestAuthentication
RequestAuthentication defines what JWT issuers are trusted, validating end-user tokens presented in HTTP requests.
Question 5: An operator wants to allow only GET requests to a service from pods in the 'frontend' namespace. Which Istio resource achieves this?
- AuthorizationPolicy (Correct answer)
- VirtualService
- PeerAuthentication
- NetworkPolicy
Correct answer: AuthorizationPolicy
AuthorizationPolicy enforces access control by specifying which sources, operations (methods), and conditions are allowed or denied.
Question 6: What does Istio's fault injection feature allow you to do?
- Simulate delays and HTTP errors to test service resilience (Correct answer)
- Inject custom sidecar containers into pods automatically
- Replace a failing service with a mock response permanently
- Inject network policies to drop packets between services
Correct answer: Simulate delays and HTTP errors to test service resilience
Fault injection via VirtualService lets you introduce artificial delays or abort responses to verify that services handle failures gracefully.
Question 7: In a Linkerd service mesh, what is the equivalent of Istio's Envoy sidecar proxy?
- linkerd-proxy (written in Rust) (Correct answer)
- NGINX reverse proxy
- HAProxy
- Envoy with Linkerd configuration
Correct answer: linkerd-proxy (written in Rust)
Linkerd uses its own ultra-lightweight proxy called linkerd-proxy, written in Rust for low latency and minimal resource usage.
CKA Service Mesh Basics 3
Which Istio resource is used to register and control traffic to external services (outside the mesh)?