Service mesh concept overview in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of a service mesh in Kubernetes?

Choose the best description of what a service mesh does in a Kubernetes environment.

A It stores container images and manages image versions for deployments.

B It schedules pods onto nodes based on resource availability and affinity rules.

C It manages network traffic between microservices, providing features like load balancing, security, and observability.

D It monitors CPU and memory usage of nodes and automatically scales the cluster size.

💡 Hint

Think about what helps microservices communicate securely and reliably inside Kubernetes.

A service mesh handles communication between microservices, adding features like load balancing, security (mTLS), and observability without changing application code.

💻 Command Output

intermediate

Output of Istio sidecar injection command

What is the output when you run the following command to label a namespace for automatic Istio sidecar injection?

kubectl label namespace default istio-injection=enabled

A namespace/default labeled

B Error from server (NotFound): namespaces "default" not found

C Warning: label istio-injection already exists

D namespace/default created

💡 Hint

Labeling a namespace adds a label; it does not create or delete namespaces.

The command adds the label 'istio-injection=enabled' to the existing 'default' namespace and confirms with 'namespace/default labeled'.

❓ Configuration

advanced

Correct YAML snippet for enabling mutual TLS in Istio

Which YAML snippet correctly enables mutual TLS (mTLS) for all services in the default namespace using Istio PeerAuthentication?

A

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: STRICT

B

apiVersion: security.istio.io/v1alpha1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    enabled: true

C

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default
  namespace: default
spec:
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

D

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: default
  namespace: default
spec:
  rules:
  - from:
    - source:
        principals: ["*"]

💡 Hint

Look for the correct apiVersion and kind that configures mTLS mode strictly.

PeerAuthentication with apiVersion security.istio.io/v1beta1 and mtls mode STRICT enables mutual TLS for all workloads in the namespace.

❓ Troubleshoot

advanced

Troubleshooting failed service-to-service communication in a service mesh

You deployed two microservices in Kubernetes with Istio service mesh enabled. Service A cannot reach Service B. Which of the following is the most likely cause?

A The cluster's DNS server is down, so pod names cannot be resolved.

B Service B's pod does not have the Istio sidecar proxy injected.

C Service A's container image is outdated and missing dependencies.

D The Kubernetes node running Service A is out of disk space.

💡 Hint

In a service mesh, communication depends on sidecar proxies intercepting traffic.

If Service B's pod lacks the Istio sidecar proxy, the mesh cannot route traffic to it, causing communication failure.

✅ Best Practice

expert

Best practice for securing service-to-service communication in a service mesh

Which practice is considered best for securing communication between microservices in a service mesh?

A Use plain HTTP for internal services and HTTPS only for external traffic.

B Disable encryption to reduce latency and rely on network firewalls only.

C Manually configure IP whitelists for each service instead of using mesh policies.

D Enable mutual TLS (mTLS) with strict mode and rotate certificates regularly.

💡 Hint

Think about encryption and automated security features in service meshes.

Enabling mTLS with strict mode ensures encrypted, authenticated communication. Regular certificate rotation maintains security.