Kubernetes Container Orchestration Service Mesh 3 — Questions and Answers
Question 1: What is the function of a 'ServiceEntry' in Istio?
- Register an external service so mesh proxies can route to it (Correct answer)
- Define retry policies for internal services
- Create a Kubernetes Service object automatically
- Enable health checks for mesh workloads
Correct answer: Register an external service so mesh proxies can route to it
ServiceEntry adds external services (outside the mesh) to Istio's service registry so that proxies can manage traffic to them.
Question 2: Which observability feature is automatically provided by most service meshes without code changes?
- Custom business metric dashboards
- Distributed tracing and golden signal metrics (Correct answer)
- Log aggregation to Elasticsearch
- Database query performance monitoring
Correct answer: Distributed tracing and golden signal metrics
Service meshes capture distributed traces and golden signals (latency, traffic, errors, saturation) at the proxy layer transparently.
Question 3: In Istio, what does setting 'trafficPolicy.outlierDetection' on a DestinationRule achieve?
- Enables circuit breaking by ejecting unhealthy hosts from the load balancing pool (Correct answer)
- Configures TLS settings for upstream connections
- Sets rate limits on incoming requests
- Defines retry attempts for failed requests
Correct answer: Enables circuit breaking by ejecting unhealthy hosts from the load balancing pool
Outlier detection in Istio monitors host health and automatically removes hosts that exhibit errors from the load balancing pool (circuit breaking).
Question 4: What is the default sidecar proxy used by Istio?
- HAProxy
- NGINX
- Envoy (Correct answer)
- Traefik
Correct answer: Envoy
Istio uses Envoy proxy as its data plane sidecar, leveraging its rich features for traffic management, observability, and security.
Question 5: How does a service mesh handle traffic between two services that belong to different namespaces?
- Traffic is blocked by default unless a NetworkPolicy allows it
- The mesh proxies intercept and route cross-namespace traffic transparently (Correct answer)
- Services must use NodePort to communicate across namespaces
- An Ingress resource must be created for each cross-namespace call
Correct answer: The mesh proxies intercept and route cross-namespace traffic transparently
Service mesh proxies intercept all traffic at the pod level, so cross-namespace communication flows through the mesh just like same-namespace traffic.
Question 6: What is 'traffic mirroring' (or shadowing) in a service mesh?
- Duplicating requests to a secondary service without affecting the primary response (Correct answer)
- Copying service configurations to a backup cluster
- Replicating pod replicas across availability zones
- Forwarding logs from one service to another
Correct answer: Duplicating requests to a secondary service without affecting the primary response
Traffic mirroring sends a copy of live traffic to a shadow service for testing, while the original service still handles and responds to the request.
Question 7: Which Linkerd component performs the actual proxy function in the data plane?
- linkerd-controller
- linkerd-proxy (linkerd2-proxy) (Correct answer)
- linkerd-tap
- linkerd-web
Correct answer: linkerd-proxy (linkerd2-proxy)
Linkerd uses linkerd2-proxy, a purpose-built ultra-lightweight Rust proxy, as the data plane sidecar in each pod.
Kubernetes Container Orchestration Service Mesh 3
What is the function of a 'ServiceEntry' in Istio?