Kubernetes Container Orchestration Service Mesh 4 — Questions and Answers
Question 1: What does the 'PeerAuthentication' resource in Istio configure?
- JWT validation for end-user authentication
- mTLS mode for communication between workloads (Correct answer)
- RBAC permissions for Kubernetes service accounts
- TLS certificates for Ingress gateways
Correct answer: mTLS mode for communication between workloads
PeerAuthentication defines how traffic between workloads (peer-to-peer) is authenticated, including whether mTLS is required, permissive, or disabled.
Question 2: In a service mesh, what is the purpose of a 'retry policy'?
- Automatically restart crashed pods
- Re-attempt failed requests a specified number of times before returning an error (Correct answer)
- Rollback a deployment on failure
- Reroute traffic when a node goes down
Correct answer: Re-attempt failed requests a specified number of times before returning an error
Retry policies instruct the proxy to automatically re-send failed requests (e.g., 503 errors) up to a configured maximum number of attempts.
Question 3: Which Istio component is responsible for distributing configuration and routing updates to Envoy proxies?
- Citadel
- Galley
- Istiod (Pilot) (Correct answer)
- Mixer
Correct answer: Istiod (Pilot)
Istiod (which consolidates Pilot, Citadel, and Galley) pushes xDS configuration updates to all Envoy sidecar proxies in the mesh.
Question 4: What is the 'xDS API' in the context of Envoy and service meshes?
- An external DNS resolution protocol
- A set of discovery service APIs used to dynamically configure Envoy proxies (Correct answer)
- A cross-datacenter synchronization protocol
- An extended deployment strategy for Kubernetes
Correct answer: A set of discovery service APIs used to dynamically configure Envoy proxies
The xDS APIs (CDS, EDS, LDS, RDS, SDS) allow control planes to push dynamic configuration updates (clusters, endpoints, listeners, routes, secrets) to Envoy.
Question 5: How does Istio's ingress Gateway differ from a standard Kubernetes Ingress?
- It only supports HTTP/1.1 traffic
- It provides full Istio traffic management features like fault injection and circuit breaking at the edge (Correct answer)
- It cannot handle TLS termination
- It is managed by the kubelet on each node
Correct answer: It provides full Istio traffic management features like fault injection and circuit breaking at the edge
Istio's Gateway resource combined with VirtualService brings all Istio traffic management capabilities (retries, fault injection, routing) to edge traffic.
Question 6: What is 'fault injection' used for in a service mesh?
- Introducing deliberate errors or delays to test service resilience (Correct answer)
- Reporting bugs in the service mesh configuration
- Injecting environment variables into containers
- Simulating node failures in Kubernetes
Correct answer: Introducing deliberate errors or delays to test service resilience
Fault injection deliberately introduces HTTP errors or latency into traffic flows to test how services handle failures — a key chaos engineering technique.
Question 7: Which CNCF project provides a service mesh interface (SMI) specification to standardize mesh APIs?
- Linkerd
- Consul Connect
- SMI (Service Mesh Interface) (Correct answer)
- Open Service Mesh
Correct answer: SMI (Service Mesh Interface)
SMI (Service Mesh Interface) is a CNCF spec that defines common APIs for traffic management, observability, and security across different mesh implementations.
Kubernetes Container Orchestration Service Mesh 4
What does the 'PeerAuthentication' resource in Istio configure?