Service mesh concept overview in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a basic service mesh sidecar proxy container in a pod spec.

Kubernetes

containers:
  - name: app
    image: myapp:latest
  - name: sidecar-proxy
    image: [1]

Drag options to blanks, or click blank then click option'

Abusybox

Balpine

Cistio/proxyv2:latest

Dnginx:latest

Attempts:

3 left

💡 Hint

Common Mistakes

Using a generic container image like nginx or alpine instead of the service mesh proxy image.

The sidecar proxy container in a service mesh often uses the Istio proxy image istio/proxyv2:latest to handle traffic routing and security.

2fill in blank

medium

Complete the command to install Istio service mesh using the Istioctl CLI.

Kubernetes

istioctl install --set profile=[1]

Drag options to blanks, or click blank then click option'

Afull

Bminimal

Ccustom

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'full' which is not a recognized profile.

Choosing 'minimal' which installs fewer components.

The default profile installs the standard Istio service mesh with common features enabled.

3fill in blank

hard

Fix the error in the YAML snippet to enable automatic sidecar injection in the namespace.

Kubernetes

apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace
  labels:
    [1]: "enabled"

Drag options to blanks, or click blank then click option'

Aistio-injection

Bsidecar-injection

Cmesh-injection

Dproxy-injection

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect label keys like 'sidecar-injection' or 'mesh-injection'.

The label istio-injection: "enabled" tells Istio to automatically inject sidecar proxies into pods in this namespace.

4fill in blank

hard

Fill both blanks to create a service mesh policy that allows mutual TLS authentication.

Kubernetes

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: [1]
spec:
  mtls:
    mode: [2]

Drag options to blanks, or click blank then click option'

Adefault

Bstrict

Cistio-system

Dpermissive

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' namespace instead of 'istio-system'.

Using 'permissive' mode which allows both encrypted and plain traffic.

The PeerAuthentication resource in the istio-system namespace with mode: strict enforces mutual TLS for all workloads.

5fill in blank

hard

Fill all three blanks to define a VirtualService routing HTTP traffic to a service.

Kubernetes

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service
spec:
  hosts:
  - [1]
  http:
  - route:
    - destination:
        host: [2]
        port:
          number: [3]

Drag options to blanks, or click blank then click option'

Amy-service.default.svc.cluster.local

Bmy-service

C80

Dmy-service.default

Attempts:

3 left

💡 Hint

Common Mistakes

Using the full cluster domain in hosts which is valid but less common.

Using incorrect port numbers or missing the port field.

The hosts field uses the short service name with namespace my-service.default. The destination.host is the service name my-service. The port number 80 is the standard HTTP port.