Kubernetes Container Orchestration Service Mesh 4

Question 1

What does the 'PeerAuthentication' resource in Istio configure?

Accepted Answer

mTLS mode for communication between workloads

Answer

PeerAuthentication defines how traffic between workloads (peer-to-peer) is authenticated, including whether mTLS is required, permissive, or disabled.

Question 2

In a service mesh, what is the purpose of a 'retry policy'?

Accepted Answer

Re-attempt failed requests a specified number of times before returning an error

Answer

Retry policies instruct the proxy to automatically re-send failed requests (e.g., 503 errors) up to a configured maximum number of attempts.

Question 3

Which Istio component is responsible for distributing configuration and routing updates to Envoy proxies?

Accepted Answer

Istiod (Pilot)

Answer

Istiod (which consolidates Pilot, Citadel, and Galley) pushes xDS configuration updates to all Envoy sidecar proxies in the mesh.

Question 4

What is the 'xDS API' in the context of Envoy and service meshes?

Accepted Answer

A set of discovery service APIs used to dynamically configure Envoy proxies

Answer

The xDS APIs (CDS, EDS, LDS, RDS, SDS) allow control planes to push dynamic configuration updates (clusters, endpoints, listeners, routes, secrets) to Envoy.

Question 5

How does Istio's ingress Gateway differ from a standard Kubernetes Ingress?

Accepted Answer

It provides full Istio traffic management features like fault injection and circuit breaking at the edge

Answer

Istio's Gateway resource combined with VirtualService brings all Istio traffic management capabilities (retries, fault injection, routing) to edge traffic.

Kubernetes Container Orchestration Practice Test

Kubernetes Container Orchestration Practice Test

Kubernetes Container Orchestration Service Mesh 4