Istio overview in Kubernetes - Mini Project: Build & Apply

Istio Overview with Kubernetes

📖 Scenario: You are working as a DevOps engineer managing microservices on Kubernetes. You want to use Istio to control and observe the traffic between your services easily.

🎯 Goal: Learn how to set up a basic Istio configuration on Kubernetes, define a simple service, and verify Istio is managing traffic.

📋 What You'll Learn

Create a Kubernetes namespace called istio-demo

Label the namespace for Istio automatic sidecar injection

Deploy a simple httpbin service in the istio-demo namespace

Verify the httpbin pod is running with the Istio sidecar container

Use kubectl commands to check the service and pod status

💡 Why This Matters

🌍 Real World

Istio helps manage microservices traffic securely and observably in Kubernetes clusters, making it easier to control communication and monitor services.

💼 Career

Understanding Istio setup and verification is essential for DevOps engineers working with Kubernetes service meshes to improve application reliability and security.

1

Create the Istio demo namespace

Create a Kubernetes namespace called istio-demo using kubectl.

Kubernetes

# Create the namespace istio-demo
# Your code here

Hint

Use kubectl create namespace istio-demo to create the namespace.

2

Label the namespace for Istio sidecar injection

Label the istio-demo namespace with istio-injection=enabled to enable automatic Istio sidecar injection.

Kubernetes

kubectl create namespace istio-demo
# Label the namespace istio-demo for Istio sidecar injection
# Your code here

Hint

Use kubectl label namespace istio-demo istio-injection=enabled.

3

Deploy the httpbin service in istio-demo namespace

Deploy the httpbin service in the istio-demo namespace using the official Istio sample YAML from https://raw.githubusercontent.com/istio/istio/release-1.18/samples/httpbin/httpbin.yaml.

Kubernetes

kubectl create namespace istio-demo
kubectl label namespace istio-demo istio-injection=enabled
# Deploy httpbin service in istio-demo namespace
# Your code here

Hint

Use kubectl apply -n istio-demo -f [URL] to deploy the service.

4

Verify the httpbin pod has Istio sidecar and is running

Use kubectl get pods -n istio-demo to check the pod status and use kubectl describe pod httpbin- -n istio-demo to verify the Istio sidecar container named istio-proxy is injected.

Kubernetes

kubectl create namespace istio-demo
kubectl label namespace istio-demo istio-injection=enabled
kubectl apply -n istio-demo -f https://raw.githubusercontent.com/istio/istio/release-1.18/samples/httpbin/httpbin.yaml
# Check pods and describe httpbin pod to verify istio-proxy container
# Your code here

Hint

Use kubectl get pods -n istio-demo and kubectl describe pod -n istio-demo -l app=httpbin to check the pod and containers.

Practice

1. What is the primary purpose of Istio in a Kubernetes environment?

easy

A. To manage Kubernetes cluster nodes

B. To secure, observe, and control application traffic

C. To deploy applications automatically

D. To store container images

Solution

1. Step 1: Understand Istio's role

   Istio is designed to manage how microservices communicate within Kubernetes by securing, observing, and controlling traffic.

2. Step 2: Compare with other options

   Managing nodes, deploying apps, and storing images are handled by other Kubernetes components, not Istio.

3. Final Answer:

   To secure, observe, and control application traffic -> Option B

4. Quick Check:

   Istio = traffic control and security [OK]

Hint: Istio manages app traffic, not nodes or images [OK]

Common Mistakes:

• Confusing Istio with Kubernetes node management
• Thinking Istio deploys apps automatically
• Assuming Istio stores container images

2. Which command correctly labels a Kubernetes namespace for automatic Istio sidecar injection?

easy

A. kubectl set namespace my-namespace istio-injection=enabled

B. kubectl annotate namespace my-namespace istio-injection=enabled

C. kubectl apply namespace my-namespace istio-injection=enabled

D. kubectl label namespace my-namespace istio-injection=enabled

Solution

1. Step 1: Identify the correct command for labeling

   The command to add a label to a namespace is 'kubectl label namespace'.

2. Step 2: Verify the label key and value

   The label key for Istio sidecar injection is 'istio-injection' and the value is 'enabled'.

3. Final Answer:

   kubectl label namespace my-namespace istio-injection=enabled -> Option D

4. Quick Check:

   Label namespace with 'istio-injection=enabled' using kubectl label [OK]

Hint: Use 'kubectl label namespace' to add labels [OK]

Common Mistakes:

• Using 'annotate' instead of 'label' for sidecar injection
• Trying 'set' or 'apply' commands incorrectly
• Missing the correct label key or value

3. After labeling the namespace for Istio sidecar injection and deploying a pod, what is the expected change in the pod's containers?

medium

A. The pod will have an additional Istio sidecar proxy container

B. The pod will have fewer containers than before

C. The pod will restart automatically without changes

D. The pod will be deleted and recreated without sidecars

Solution

1. Step 1: Understand sidecar injection effect

   Labeling the namespace enables automatic injection of the Istio sidecar proxy container into new pods.

2. Step 2: Observe pod container count

   The pod will have its original containers plus one additional sidecar container for Istio.

3. Final Answer:

   The pod will have an additional Istio sidecar proxy container -> Option A

4. Quick Check:

   Sidecar injection adds a container to pods [OK]

Hint: Sidecar injection adds one container per pod [OK]

Common Mistakes:

• Expecting fewer containers after injection
• Thinking pods restart without container changes
• Assuming pods get deleted instead of modified

4. You labeled the namespace for Istio sidecar injection but new pods do not have the sidecar container. What is the most likely cause?

medium

A. All of the above

B. Istio components are not installed in the cluster

C. Pods were created before labeling and not restarted

D. Namespace was not labeled correctly or label was misspelled

Solution

1. Step 1: Check namespace labeling

   If the label is missing or misspelled, sidecar injection won't trigger.

2. Step 2: Verify Istio installation and pod creation timing

   Istio must be installed; pods created before labeling need restart to get sidecars.

3. Step 3: Combine all causes

   Any of these issues can cause missing sidecars, so all are possible reasons.

4. Final Answer:

   All of the above -> Option A

5. Quick Check:

   Label, install, and pod timing all affect sidecar injection [OK]

Hint: Check label, Istio install, and pod restart [OK]

Common Mistakes:

• Ignoring pod restart after labeling
• Assuming labeling alone is enough
• Not verifying Istio installation

5. You want to secure communication between microservices using Istio. Which Istio feature should you enable to encrypt traffic automatically?

hard

A. Istio Gateway for external traffic routing

B. Sidecar injection for logging only

C. Mutual TLS (mTLS) for service-to-service encryption

D. Prometheus integration for monitoring

Solution

1. Step 1: Identify Istio features for security

   Mutual TLS (mTLS) encrypts traffic between services automatically within the mesh.

2. Step 2: Differentiate other features

   Sidecar injection adds proxies but does not alone encrypt traffic; Gateways route external traffic; Prometheus is for monitoring.

3. Final Answer:

   Mutual TLS (mTLS) for service-to-service encryption -> Option C

4. Quick Check:

   mTLS = automatic encryption in Istio [OK]

Hint: Use mTLS to encrypt service traffic automatically [OK]

Common Mistakes:

• Confusing sidecar injection with encryption
• Thinking Gateway secures internal traffic
• Mixing monitoring tools with security features