Sidecar proxy concept (Envoy) in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add Envoy as a sidecar container in a Kubernetes Pod spec.

Kubernetes

containers:
  - name: app-container
    image: myapp:latest
  - name: envoy-proxy
    image: [1]

Drag options to blanks, or click blank then click option'

Abusybox

Bnginx:latest

Credis:alpine

Denvoyproxy/envoy:v1.22.0

Attempts:

3 left

💡 Hint

Common Mistakes

Using unrelated container images like nginx or redis for Envoy.

The Envoy sidecar container uses the official Envoy image envoyproxy/envoy:v1.22.0 to run the proxy alongside the app container.

2fill in blank

medium

Complete the Envoy container spec to expose the admin interface on port 9901.

Kubernetes

containers:
  - name: envoy-proxy
    image: envoyproxy/envoy:v1.22.0
    ports:
      - containerPort: [1]

Drag options to blanks, or click blank then click option'

A8080

B9901

C443

D15000

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 8080 or 443 which are common for app traffic, not admin.

Envoy's admin interface commonly listens on port 9901, which helps in monitoring and debugging.

3fill in blank

hard

Fix the error in the Envoy sidecar container args to specify the config file path.

Kubernetes

containers:
  - name: envoy-proxy
    image: envoyproxy/envoy:v1.22.0
    args: ["-c", [1]]

Drag options to blanks, or click blank then click option'

A'/etc/envoy/envoy.yaml'

B/etc/envoy/envoy.yaml

C"/etc/envoy/envoy.yaml"

D/etc/envoy/envoy.yml

Attempts:

3 left

💡 Hint

Common Mistakes

Missing quotes causing YAML parsing errors.

Using wrong file extension '.yml' instead of '.yaml'.

The argument value must be a string with quotes inside the YAML list, so use double quotes inside the array.

4fill in blank

hard

Fill both blanks to define a Kubernetes Pod annotation and Envoy container env var for proxying.

Kubernetes

metadata:
  annotations:
    sidecar.istio.io/inject: [1]
containers:
  - name: envoy-proxy
    env:
      - name: PROXY_MODE
        value: [2]

Drag options to blanks, or click blank then click option'

A"false"

B"true"

C"default"

D"enabled"

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 'true' and 'false' for injection.

Using incorrect env var values.

The annotation disables sidecar injection with "false", and the Envoy proxy mode is set to "default".

5fill in blank

hard

Fill all three blanks to create an Envoy bootstrap config map with keys for node id, cluster, and admin port.

Kubernetes

apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-bootstrap
data:
  node_id: [1]
  cluster: [2]
  admin_port: "[3]"

Drag options to blanks, or click blank then click option'

A"sidecar~10.0.0.1~pod-123~default.svc.cluster.local"

B"service-cluster"

C9901

D15090

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong port numbers or missing quotes for strings.

The node_id is a unique Envoy identifier, the cluster name is 'service-cluster', and the admin port is set to '9901'.

Practice

1. What is the main purpose of a sidecar proxy like Envoy in a Kubernetes pod?

easy

A. To manage network traffic for the application without changing its code

B. To replace the main application container

C. To store application data persistently

D. To run database services inside the pod

Solution

1. Step 1: Understand the role of sidecar proxies

   Sidecar proxies like Envoy run alongside the main app to handle network tasks such as routing, security, and monitoring.

2. Step 2: Identify what sidecars do not do

   They do not replace the app, store data, or run databases; they only assist with traffic management.

3. Final Answer:

   To manage network traffic for the application without changing its code -> Option A

4. Quick Check:

   Sidecar proxy = traffic manager [OK]

Hint: Sidecar proxies help apps with traffic, not replace them [OK]

Common Mistakes:

• Thinking sidecar replaces the app container
• Confusing sidecar with storage or database
• Assuming sidecar changes app code

2. Which of the following is the correct way to define a sidecar container for Envoy in a Kubernetes pod spec?

easy

A. containers: - name: app - image: envoyproxy/envoy

B. containers: - name: envoy - image: envoyproxy/envoy

C. containers: - name: envoy - image: nginx

D. containers: - name: envoyproxy - image: envoyproxy/envoy

Solution

1. Step 1: Identify the correct container name and image

   The sidecar container should be named clearly (e.g., 'envoy') and use the official Envoy image 'envoyproxy/envoy'.

2. Step 2: Check the options for correctness

   containers: - name: envoy - image: envoyproxy/envoy correctly names the container 'envoy' and uses the right image. containers: - name: app - image: envoyproxy/envoy misnames the container as 'app'. containers: - name: envoy - image: nginx uses the wrong image 'nginx'. containers: - name: envoyproxy - image: envoyproxy/envoy uses a different container name but correct image.

3. Final Answer:

   containers: - name: envoy - image: envoyproxy/envoy -> Option B

4. Quick Check:

   Envoy container name and image must match [OK]

Hint: Sidecar container name 'envoy' with image 'envoyproxy/envoy' [OK]

Common Mistakes:

• Using wrong container name for Envoy
• Using incorrect image like nginx
• Mixing app container with sidecar container

3. Given a pod with two containers: an app and an Envoy sidecar proxy, what happens when the app sends a request to an external service?

medium

A. The request goes directly from the app container to the external service without passing Envoy.

B. The request is duplicated and sent twice, once by the app and once by Envoy.

C. The request is blocked by Kubernetes and never leaves the pod.

D. The request is intercepted and routed through the Envoy sidecar proxy before reaching the external service.

Solution

1. Step 1: Understand Envoy's role as a sidecar proxy

   Envoy intercepts outbound requests from the app container to manage traffic, security, and monitoring.

2. Step 2: Trace the request flow

   The app's request is routed through Envoy before reaching the external service, enabling control and visibility.

3. Final Answer:

   The request is intercepted and routed through the Envoy sidecar proxy before reaching the external service. -> Option D

4. Quick Check:

   Envoy intercepts outbound traffic [OK]

Hint: Envoy sidecar intercepts app traffic to external services [OK]

Common Mistakes:

• Assuming app bypasses Envoy for external calls
• Thinking Kubernetes blocks outbound requests
• Believing requests are duplicated

4. You notice that your Envoy sidecar proxy is not forwarding traffic correctly. Which of the following is the most likely cause?

medium

A. The Kubernetes node is running out of CPU resources.

B. The app container image is outdated.

C. The Envoy container is missing required network permissions or capabilities.

D. The pod has only one container defined.

Solution

1. Step 1: Analyze Envoy sidecar traffic issues

   Envoy needs proper network permissions (like NET_ADMIN) to intercept and forward traffic.

2. Step 2: Evaluate other options

   App image version or node CPU issues may affect performance but not specifically Envoy forwarding. A pod with one container means no sidecar exists.

3. Final Answer:

   The Envoy container is missing required network permissions or capabilities. -> Option C

4. Quick Check:

   Envoy needs network permissions to forward traffic [OK]

Hint: Check Envoy network permissions if traffic not forwarded [OK]

Common Mistakes:

• Blaming app container image for Envoy issues
• Ignoring network capabilities needed by Envoy
• Assuming pod must have one container only

5. You want to add an Envoy sidecar proxy to an existing Kubernetes deployment without changing the app code. Which approach is best to achieve this?

hard

A. Modify the deployment YAML to add an Envoy container in the pod spec as a sidecar

B. Replace the app container image with one that includes Envoy inside

C. Create a separate pod running Envoy and route traffic through it externally

D. Add an init container that installs Envoy inside the app container at startup

Solution

1. Step 1: Understand sidecar pattern in Kubernetes

   Sidecars run as additional containers in the same pod, so modifying the pod spec to add Envoy is the standard way.

2. Step 2: Evaluate alternatives

   Replacing app image changes code, separate pods lose pod-local benefits, and init containers run before app start and can't run sidecars.

3. Final Answer:

   Modify the deployment YAML to add an Envoy container in the pod spec as a sidecar -> Option A

4. Quick Check:

   Add Envoy as sidecar container in pod spec [OK]

Hint: Add Envoy container to pod spec, no app code change needed [OK]

Common Mistakes:

• Replacing app image instead of adding sidecar
• Using separate pods losing sidecar benefits
• Misusing init containers for sidecar functionality