Istio overview in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Istio in the context of Kubernetes?

Istio is a service mesh that helps manage, secure, and observe communication between microservices in Kubernetes clusters.

intermediate

Name the three main components of Istio.

Istio has three main components: Envoy (a sidecar proxy), Pilot (traffic management), and Mixer (policy and telemetry).

intermediate

How does Istio improve security between microservices?

Istio uses mutual TLS to encrypt traffic between services and provides fine-grained access control policies.

beginner

What role does the Envoy proxy play in Istio?

Envoy runs as a sidecar next to each service, intercepting and managing all network traffic to and from the service.

beginner

Why is Istio useful for observability in microservices?

Istio collects metrics, logs, and traces from service traffic, helping teams monitor and troubleshoot their applications easily.

What is the primary purpose of Istio in Kubernetes?

A Manage communication between microservices

B Store container images

C Schedule pods on nodes

D Provide persistent storage

Istio manages and controls communication between microservices, unlike scheduling or storage.

Which Istio component acts as a sidecar proxy?

A Envoy

B Pilot

C Mixer

D Kubelet

Envoy runs as a sidecar proxy to handle network traffic for services.

How does Istio secure service-to-service communication?

A By storing passwords in plain text

B By disabling network traffic

C By using mutual TLS encryption

D By using HTTP only

Istio uses mutual TLS to encrypt and secure communication between services.

Which Istio component is responsible for policy enforcement and telemetry?

A Scheduler

B Pilot

C Envoy

D Mixer

Mixer handles policy checks and collects telemetry data.

What benefit does Istio provide for observability?

A Creates container images

B Collects metrics, logs, and traces

C Manages Kubernetes nodes

D Runs database backups

Istio gathers data to help monitor and troubleshoot microservices.

Explain what Istio is and why it is used in Kubernetes environments.

Think about how microservices talk to each other and how Istio helps.

Describe the role of the Envoy proxy in Istio's architecture.

Envoy runs alongside each service to handle its network traffic.

Practice

1. What is the primary purpose of Istio in a Kubernetes environment?

easy

A. To manage Kubernetes cluster nodes

B. To secure, observe, and control application traffic

C. To deploy applications automatically

D. To store container images

Solution

1. Step 1: Understand Istio's role

   Istio is designed to manage how microservices communicate within Kubernetes by securing, observing, and controlling traffic.

2. Step 2: Compare with other options

   Managing nodes, deploying apps, and storing images are handled by other Kubernetes components, not Istio.

3. Final Answer:

   To secure, observe, and control application traffic -> Option B

4. Quick Check:

   Istio = traffic control and security [OK]

Hint: Istio manages app traffic, not nodes or images [OK]

Common Mistakes:

• Confusing Istio with Kubernetes node management
• Thinking Istio deploys apps automatically
• Assuming Istio stores container images

2. Which command correctly labels a Kubernetes namespace for automatic Istio sidecar injection?

easy

A. kubectl set namespace my-namespace istio-injection=enabled

B. kubectl annotate namespace my-namespace istio-injection=enabled

C. kubectl apply namespace my-namespace istio-injection=enabled

D. kubectl label namespace my-namespace istio-injection=enabled

Solution

1. Step 1: Identify the correct command for labeling

   The command to add a label to a namespace is 'kubectl label namespace'.

2. Step 2: Verify the label key and value

   The label key for Istio sidecar injection is 'istio-injection' and the value is 'enabled'.

3. Final Answer:

   kubectl label namespace my-namespace istio-injection=enabled -> Option D

4. Quick Check:

   Label namespace with 'istio-injection=enabled' using kubectl label [OK]

Hint: Use 'kubectl label namespace' to add labels [OK]

Common Mistakes:

• Using 'annotate' instead of 'label' for sidecar injection
• Trying 'set' or 'apply' commands incorrectly
• Missing the correct label key or value

3. After labeling the namespace for Istio sidecar injection and deploying a pod, what is the expected change in the pod's containers?

medium

A. The pod will have an additional Istio sidecar proxy container

B. The pod will have fewer containers than before

C. The pod will restart automatically without changes

D. The pod will be deleted and recreated without sidecars

Solution

1. Step 1: Understand sidecar injection effect

   Labeling the namespace enables automatic injection of the Istio sidecar proxy container into new pods.

2. Step 2: Observe pod container count

   The pod will have its original containers plus one additional sidecar container for Istio.

3. Final Answer:

   The pod will have an additional Istio sidecar proxy container -> Option A

4. Quick Check:

   Sidecar injection adds a container to pods [OK]

Hint: Sidecar injection adds one container per pod [OK]

Common Mistakes:

• Expecting fewer containers after injection
• Thinking pods restart without container changes
• Assuming pods get deleted instead of modified

4. You labeled the namespace for Istio sidecar injection but new pods do not have the sidecar container. What is the most likely cause?

medium

A. All of the above

B. Istio components are not installed in the cluster

C. Pods were created before labeling and not restarted

D. Namespace was not labeled correctly or label was misspelled

Solution

1. Step 1: Check namespace labeling

   If the label is missing or misspelled, sidecar injection won't trigger.

2. Step 2: Verify Istio installation and pod creation timing

   Istio must be installed; pods created before labeling need restart to get sidecars.

3. Step 3: Combine all causes

   Any of these issues can cause missing sidecars, so all are possible reasons.

4. Final Answer:

   All of the above -> Option A

5. Quick Check:

   Label, install, and pod timing all affect sidecar injection [OK]

Hint: Check label, Istio install, and pod restart [OK]

Common Mistakes:

• Ignoring pod restart after labeling
• Assuming labeling alone is enough
• Not verifying Istio installation

5. You want to secure communication between microservices using Istio. Which Istio feature should you enable to encrypt traffic automatically?

hard

A. Istio Gateway for external traffic routing

B. Sidecar injection for logging only

C. Mutual TLS (mTLS) for service-to-service encryption

D. Prometheus integration for monitoring

Solution

1. Step 1: Identify Istio features for security

   Mutual TLS (mTLS) encrypts traffic between services automatically within the mesh.

2. Step 2: Differentiate other features

   Sidecar injection adds proxies but does not alone encrypt traffic; Gateways route external traffic; Prometheus is for monitoring.

3. Final Answer:

   Mutual TLS (mTLS) for service-to-service encryption -> Option C

4. Quick Check:

   mTLS = automatic encryption in Istio [OK]

Hint: Use mTLS to encrypt service traffic automatically [OK]

Common Mistakes:

• Confusing sidecar injection with encryption
• Thinking Gateway secures internal traffic
• Mixing monitoring tools with security features