Kubernetes Container Orchestration Service Mesh 2 — Questions and Answers
Question 1: Which component in Istio is responsible for policy enforcement and telemetry collection?
- Pilot
- Citadel
- Mixer (Correct answer)
- Galley
Correct answer: Mixer
Mixer (in older Istio versions) handles policy enforcement and telemetry aggregation from the data plane proxies.
Question 2: What is the purpose of a VirtualService in Istio?
- Define health check endpoints for pods
- Configure traffic routing rules for a service (Correct answer)
- Expose services outside the cluster
- Manage TLS certificate rotation
Correct answer: Configure traffic routing rules for a service
A VirtualService defines how requests are routed to a service, enabling advanced traffic management like weighted routing and retries.
Question 3: In Linkerd, what is the role of the 'control plane' component called the 'destination' service?
- Generates mTLS certificates for proxies
- Provides service discovery and routing policy to proxies (Correct answer)
- Collects metrics from data plane proxies
- Manages ingress traffic into the mesh
Correct answer: Provides service discovery and routing policy to proxies
The destination service in Linkerd's control plane provides service discovery information and routing policy to the data plane proxies.
Question 4: Which Istio resource is used to define a set of traffic policies that apply to a specific service version?
- VirtualService
- Gateway
- DestinationRule (Correct answer)
- ServiceEntry
Correct answer: DestinationRule
DestinationRule defines policies like load balancing, connection pooling, and circuit breaking that apply after routing has occurred.
Question 5: What does 'canary deployment' mean in the context of a service mesh?
- Deploying all traffic to a new version at once
- Routing a small percentage of traffic to a new version while the rest goes to the stable version (Correct answer)
- Rolling back a failed deployment automatically
- Testing a service only in a staging environment
Correct answer: Routing a small percentage of traffic to a new version while the rest goes to the stable version
Canary deployment gradually shifts traffic to a new version, allowing teams to validate it with a subset of users before full rollout.
Question 6: Which protocol does a service mesh primarily use to secure communication between services?
- SSL/TLS with manually managed certificates
- mTLS (mutual TLS) (Correct answer)
- SSH tunneling
- IPSec VPN
Correct answer: mTLS (mutual TLS)
Service meshes use mutual TLS (mTLS) so both the client and server authenticate each other, ensuring encrypted and verified communication.
Question 7: What is an AuthorizationPolicy in Istio used for?
- Configuring JWT token generation
- Defining which services or users are allowed to access a specific service (Correct answer)
- Managing Kubernetes RBAC rules
- Automating certificate renewal
Correct answer: Defining which services or users are allowed to access a specific service
AuthorizationPolicy in Istio controls access to workloads by specifying which principals and conditions are allowed to make requests.
Kubernetes Container Orchestration Service Mesh 2
Which component in Istio is responsible for policy enforcement and telemetry collection?