Service Mesh Flashcards

What is an 'ambient mesh' in the context of Istio's evolution?

Answer: A sidecar-less mesh architecture using shared node-level proxies (ztunnel)

Istio ambient mesh removes per-pod sidecars by using a per-node ztunnel proxy for L4 and optional waypoint proxies for L7 policies.

Which service mesh feature prevents cascading failures by stopping requests to an unhealthy service after a threshold of failures?

Answer: Circuit breaker

A circuit breaker opens after a configured failure threshold, stopping further requests to the unhealthy service and allowing it time to recover.

In Istio, which resource type enforces access control by allowing or denying requests based on source identity or HTTP attributes?

Answer: AuthorizationPolicy

AuthorizationPolicy defines allow/deny rules based on service account identities, namespaces, HTTP methods, and headers.

What is the SPIFFE standard used for in a service mesh?

Answer: Providing a framework for cryptographic service identity via SVIDs

SPIFFE (Secure Production Identity Framework for Everyone) provides a standard for issuing cryptographic identities (SVIDs) to workloads.

Which observability concept involves tracking a request across multiple services using correlated trace spans?

Answer: Distributed tracing

Distributed tracing propagates a trace ID across service calls, allowing you to see the full path and latency of a request through the system.

In a service mesh canary deployment, what percentage of traffic is initially sent to the new version?

Answer: A small percentage, typically 1-10%

Canary deployments route a small fraction of live traffic to the new version to validate it before a full rollout.

What protocol does Istio's Envoy proxy use to communicate with the Istiod control plane for configuration updates?

Answer: gRPC via xDS APIs

Envoy proxies use the xDS (discovery service) APIs over gRPC to receive dynamic configuration updates from Istiod.