Advanced
Service Mesh
#service-mesh#istio#envoy
Service Mesh Fundamentals — Vocabulary
5 exercises — 5 exercises practising the core vocabulary of service meshes — data plane, control plane, sidecar proxies, and Istio architecture.
0 / 30 completed
1 / 30
A colleague asks you to explain the difference between the data plane and the control plane in Istio. Which answer is most accurate?
The data plane (Envoy sidecars) handles real traffic; the control plane (istiod) handles configuration distribution — these are completely separate concerns.
This separation is fundamental to service mesh architecture. istiod translates your Istio YAML resources into xDS (Envoy discovery service) configuration and pushes it to the relevant sidecar proxies via gRPC streaming. When a request flows from service A to service B, it goes: A's container → A's Envoy sidecar → network → B's Envoy sidecar → B's container. istiod is never in that path — it only tells the sidecars what to do.
Key vocabulary:
• data plane — the Envoy sidecar proxies; handle actual request traffic
• control plane — istiod; distributes xDS config; no traffic flows through it
• xDS — Envoy's discovery service API; how control plane pushes config to data plane
This separation is fundamental to service mesh architecture. istiod translates your Istio YAML resources into xDS (Envoy discovery service) configuration and pushes it to the relevant sidecar proxies via gRPC streaming. When a request flows from service A to service B, it goes: A's container → A's Envoy sidecar → network → B's Envoy sidecar → B's container. istiod is never in that path — it only tells the sidecars what to do.
Key vocabulary:
• data plane — the Envoy sidecar proxies; handle actual request traffic
• control plane — istiod; distributes xDS config; no traffic flows through it
• xDS — Envoy's discovery service API; how control plane pushes config to data plane
2 / 30
You are explaining sidecar injection to a developer who is new to Kubernetes. Which description is most accurate?
Sidecar injection uses a mutating admission webhook to transparently add the Envoy container — the application code requires zero changes.
When a pod is created in an injection-enabled namespace, the Kubernetes API server calls Istio's webhook before scheduling. The webhook patches the pod spec: it adds the istio-proxy (Envoy) container and an init container that sets up iptables rules redirecting all inbound/outbound traffic through the proxy ports. The application sees only localhost — it has no idea a proxy is intercepting its traffic.
Key vocabulary:
• mutating admission webhook — intercepts pod creation and modifies the pod spec before it is saved
• iptables rules — redirect traffic to/from Envoy's port (15001 outbound, 15006 inbound) transparently
• istio-proxy — the name of the Envoy sidecar container added by Istio injection
When a pod is created in an injection-enabled namespace, the Kubernetes API server calls Istio's webhook before scheduling. The webhook patches the pod spec: it adds the istio-proxy (Envoy) container and an init container that sets up iptables rules redirecting all inbound/outbound traffic through the proxy ports. The application sees only localhost — it has no idea a proxy is intercepting its traffic.
Key vocabulary:
• mutating admission webhook — intercepts pod creation and modifies the pod spec before it is saved
• iptables rules — redirect traffic to/from Envoy's port (15001 outbound, 15006 inbound) transparently
• istio-proxy — the name of the Envoy sidecar container added by Istio injection
3 / 30
During a platform review, a team asks about the difference between east-west traffic and north-south traffic in the context of a service mesh. Which explanation is correct?
East-west = internal service-to-service; north-south = external traffic at the cluster boundary — the service mesh's primary value is in the east-west layer.
The naming comes from network diagrams: services in a row communicate horizontally (east-west); traffic entering from outside comes from the top (north). The Istio service mesh excels at east-west: it applies mTLS, retries, timeouts, and observability between your microservices automatically. North-south traffic (from a user's browser or an external API) enters via the Istio Ingress Gateway, which is a specialized Envoy instance that bridges external to internal.
Key vocabulary:
• east-west traffic — internal, service-to-service; managed by sidecar proxies
• north-south traffic — external-to-cluster or cluster-to-external; managed by the Ingress/Egress Gateway
• Ingress Gateway — Istio resource defining how external traffic enters the mesh
The naming comes from network diagrams: services in a row communicate horizontally (east-west); traffic entering from outside comes from the top (north). The Istio service mesh excels at east-west: it applies mTLS, retries, timeouts, and observability between your microservices automatically. North-south traffic (from a user's browser or an external API) enters via the Istio Ingress Gateway, which is a specialized Envoy instance that bridges external to internal.
Key vocabulary:
• east-west traffic — internal, service-to-service; managed by sidecar proxies
• north-south traffic — external-to-cluster or cluster-to-external; managed by the Ingress/Egress Gateway
• Ingress Gateway — Istio resource defining how external traffic enters the mesh
4 / 30
A team is evaluating ambient mesh (Istio's sidecar-less mode) versus the traditional sidecar model. Which statement correctly describes the trade-off?
Ambient mesh reduces per-pod overhead by moving from per-pod sidecars to per-node ztunnel + on-demand waypoint proxies for L7 features.
In a high-density cluster with 500 pods, the sidecar model means 500 Envoy containers (each using ~50MB RAM minimum). Ambient mode deploys one ztunnel daemonset per node — far fewer proxy instances. The catch: L7 features (retries, header-based routing, fault injection) require deploying a waypoint proxy per namespace or service. So ambient mode is simpler and cheaper for services that only need mTLS and basic L4 policies, but adds a waypoint proxy step for services needing L7 traffic management.
Key vocabulary:
• ztunnel — per-node proxy in ambient mode; handles L4 mTLS and basic authorization
• waypoint proxy — per-namespace/service proxy in ambient mode; handles L7 features on demand
• ambient mesh — Istio's sidecar-less architecture; generally available since Istio 1.22
In a high-density cluster with 500 pods, the sidecar model means 500 Envoy containers (each using ~50MB RAM minimum). Ambient mode deploys one ztunnel daemonset per node — far fewer proxy instances. The catch: L7 features (retries, header-based routing, fault injection) require deploying a waypoint proxy per namespace or service. So ambient mode is simpler and cheaper for services that only need mTLS and basic L4 policies, but adds a waypoint proxy step for services needing L7 traffic management.
Key vocabulary:
• ztunnel — per-node proxy in ambient mode; handles L4 mTLS and basic authorization
• waypoint proxy — per-namespace/service proxy in ambient mode; handles L7 features on demand
• ambient mesh — Istio's sidecar-less architecture; generally available since Istio 1.22
5 / 30
A colleague says: "I'll enable the service mesh on our namespace today — the app will need to be updated to handle mTLS." What is wrong with this statement?
One of the key values of a service mesh is transparent mTLS — zero application code changes required.
When mTLS PeerAuthentication is enabled, the Envoy sidecars handle the full TLS handshake transparently. Service A's application sends a plain HTTP request to service B. Service A's Envoy intercepts it, wraps it in mTLS, and forwards it to Service B's Envoy, which terminates the TLS and delivers plain HTTP to B's container. Both application containers continue to use plain text internally. This is a fundamental selling point of the mesh: you get encryption and identity verification with no application refactoring.
Key vocabulary:
• transparent mTLS — TLS handled by sidecars; app code uses plain HTTP
• PeerAuthentication — Istio resource configuring mTLS mode (STRICT/PERMISSIVE/DISABLE) per namespace
• STRICT mode — all traffic must use mTLS; plain-text connections are rejected
When mTLS PeerAuthentication is enabled, the Envoy sidecars handle the full TLS handshake transparently. Service A's application sends a plain HTTP request to service B. Service A's Envoy intercepts it, wraps it in mTLS, and forwards it to Service B's Envoy, which terminates the TLS and delivers plain HTTP to B's container. Both application containers continue to use plain text internally. This is a fundamental selling point of the mesh: you get encryption and identity verification with no application refactoring.
Key vocabulary:
• transparent mTLS — TLS handled by sidecars; app code uses plain HTTP
• PeerAuthentication — Istio resource configuring mTLS mode (STRICT/PERMISSIVE/DISABLE) per namespace
• STRICT mode — all traffic must use mTLS; plain-text connections are rejected
6 / 30
Alice: "Hey, I'm seeing a lot of latency spikes when our backend service, OrderService, calls the PaymentGateway. I've checked the database and network, but nothing obvious. I was thinking about using Envoy rules to prioritize traffic based on service health. Does this align with how service meshes typically handle these kinds of issues?"This question tests understanding of Envoy's role within a service mesh. The core concept is that service meshes provide *dynamic* routing and policy enforcement – this is precisely what Envoy does. A correct answer recognizes this capability, while the other options misinterpret Envoy's function or suggest it solves underlying problems outside its scope.
7 / 30
Ben (in a Slack channel): "I'm trying to understand how service mesh traffic management works. I keep hearing about 'traffic shadowing'. What does that actually mean?"The correct answer accurately describes traffic shadowing – it's about mirroring traffic for observation and control. The other options present common service mesh concepts (debugging, load balancing, security) but don't capture the specific meaning of traffic shadowing. This tests a precise vocabulary point.
8 / 30
Charlie (in a PR description): "Implemented mTLS for all outbound traffic from the UserAuthService. This will ensure secure communication with downstream services and prevent man-in-the-middle attacks. We've also configured Envoy to automatically handle certificate rotation."The question assesses the understanding of how mTLS fits into a service mesh. The description correctly highlights the combination of automated certificate rotation and mTLS as a best practice for secure communication. It's important to recognize that this is a *simplified* view – a full security strategy would involve more considerations, but this accurately reflects the core functionality.
9 / 30
David: "Our team is debating whether to continue using the traditional sidecar model for our service mesh or migrate to ambient mesh. What's the primary advantage of ambient mesh?"This question focuses on a key trade-off between service mesh architectures. Ambient mesh's primary advantage is reduced operational overhead – the elimination of sidecar proxies significantly simplifies deployment and reduces resource consumption. The other options misrepresent the benefits or introduce incorrect assumptions about performance, security, or control.
10 / 30
Eve: "I'm deploying a new microservice and need to integrate it into our existing service mesh. I've configured the mTLS policies correctly, but I'm getting intermittent connection errors. I suspect there might be an issue with Envoy's probe configuration."This scenario tests understanding of Envoy probe configuration within a service mesh. Envoy probes are crucial for monitoring service health and influencing traffic routing decisions. A misconfigured probe can indeed lead to intermittent connection errors, highlighting the importance of proper configuration.
11 / 30
Alice: "Hey, I'm seeing a lot of latency spikes when our backend service, OrderService, calls the PaymentGateway. I've checked the database and network, but nothing obvious. I was thinking about using Envoy rules to prioritize traffic based on service health. Does this align with how service meshes typically handle these kinds of issues?"This question tests understanding of Envoy's role within a service mesh. The core concept is that service meshes provide *dynamic* routing and policy enforcement – this is precisely what Envoy does. A correct answer recognizes this capability, while the other options misinterpret Envoy's function or suggest it solves underlying problems outside its scope.
12 / 30
Ben (in a Slack channel): "I'm trying to understand how service mesh traffic management works. I keep hearing about 'traffic shadowing'. What does that actually mean?"The correct answer accurately describes traffic shadowing – it's about mirroring traffic for observation and control. The other options present common service mesh concepts (debugging, load balancing, security) but don't capture the specific meaning of traffic shadowing. This tests a precise vocabulary point.
13 / 30
Charlie (in a PR description): "Implemented mTLS for all outbound traffic from the UserAuthService. This will ensure secure communication with downstream services and prevent man-in-the-middle attacks. We've also configured Envoy to automatically handle certificate rotation."The question assesses the understanding of how mTLS fits into a service mesh. The description correctly highlights the combination of automated certificate rotation and mTLS as a best practice for secure communication. It's important to recognize that this is a *simplified* view – a full security strategy would involve more considerations, but this accurately reflects the core functionality.
14 / 30
David: "Our team is debating whether to continue using the traditional sidecar model for our service mesh or migrate to ambient mesh. What's the primary advantage of ambient mesh?"This question focuses on a key trade-off between service mesh architectures. Ambient mesh's primary advantage is reduced operational overhead – the elimination of sidecar proxies significantly simplifies deployment and reduces resource consumption. The other options misrepresent the benefits or introduce incorrect assumptions about performance, security, or control.
15 / 30
Eve: "I'm deploying a new microservice and need to integrate it into our existing service mesh. I've configured the mTLS policies correctly, but I'm getting intermittent connection errors. I suspect there might be an issue with Envoy's probe configuration."This scenario tests understanding of Envoy probe configuration within a service mesh. Envoy probes are crucial for monitoring service health and influencing traffic routing decisions. A misconfigured probe can indeed lead to intermittent connection errors, highlighting the importance of proper configuration.
16 / 30
Alice: "Hey, I'm seeing a lot of latency spikes when our backend service, OrderService, calls the PaymentGateway. I've checked the database and network, but nothing obvious. I was thinking about using Envoy rules to prioritize traffic based on service health. Does this align with how service meshes typically handle these kinds of issues?"This question tests understanding of Envoy's role within a service mesh. The core concept is that service meshes provide *dynamic* routing and policy enforcement – this is precisely what Envoy does. A correct answer recognizes this capability, while the other options misinterpret Envoy's function or suggest it solves underlying problems outside its scope.
17 / 30
Ben (in a Slack channel): "I'm trying to understand how service mesh traffic management works. I keep hearing about 'traffic shadowing'. What does that actually mean?"The correct answer accurately describes traffic shadowing – it's about mirroring traffic for observation and control. The other options present common service mesh concepts (debugging, load balancing, security) but don't capture the specific meaning of traffic shadowing. This tests a precise vocabulary point.
18 / 30
Charlie (in a PR description): "Implemented mTLS for all outbound traffic from the UserAuthService. This will ensure secure communication with downstream services and prevent man-in-the-middle attacks. We've also configured Envoy to automatically handle certificate rotation."The question assesses the understanding of how mTLS fits into a service mesh. The description correctly highlights the combination of automated certificate rotation and mTLS as a best practice for secure communication. It's important to recognize that this is a *simplified* view – a full security strategy would involve more considerations, but this accurately reflects the core functionality.
19 / 30
David: "Our team is debating whether to continue using the traditional sidecar model for our service mesh or migrate to ambient mesh. What's the primary advantage of ambient mesh?"This question focuses on a key trade-off between service mesh architectures. Ambient mesh's primary advantage is reduced operational overhead – the elimination of sidecar proxies significantly simplifies deployment and reduces resource consumption. The other options misrepresent the benefits or introduce incorrect assumptions about performance, security, or control.
20 / 30
Eve: "I'm deploying a new microservice and need to integrate it into our existing service mesh. I've configured the mTLS policies correctly, but I'm getting intermittent connection errors. I suspect there might be an issue with Envoy's probe configuration."This scenario tests understanding of Envoy probe configuration within a service mesh. Envoy probes are crucial for monitoring service health and influencing traffic routing decisions. A misconfigured probe can indeed lead to intermittent connection errors, highlighting the importance of proper configuration.
21 / 30
Alice: "Hey, I'm seeing a lot of latency spikes when our backend service, OrderService, calls the PaymentGateway. I've checked the database and network, but nothing obvious. I was thinking about using Envoy rules to prioritize traffic based on service health. Does this align with how service meshes typically handle these kinds of issues?"This question tests understanding of Envoy's role within a service mesh. The core concept is that service meshes provide *dynamic* routing and policy enforcement – this is precisely what Envoy does. A correct answer recognizes this capability, while the other options misinterpret Envoy's function or suggest it solves underlying problems outside its scope.
22 / 30
Ben (in a Slack channel): "I'm trying to understand how service mesh traffic management works. I keep hearing about 'traffic shadowing'. What does that actually mean?"The correct answer accurately describes traffic shadowing – it's about mirroring traffic for observation and control. The other options present common service mesh concepts (debugging, load balancing, security) but don't capture the specific meaning of traffic shadowing. This tests a precise vocabulary point.
23 / 30
Charlie (in a PR description): "Implemented mTLS for all outbound traffic from the UserAuthService. This will ensure secure communication with downstream services and prevent man-in-the-middle attacks. We've also configured Envoy to automatically handle certificate rotation."The question assesses the understanding of how mTLS fits into a service mesh. The description correctly highlights the combination of automated certificate rotation and mTLS as a best practice for secure communication. It's important to recognize that this is a *simplified* view – a full security strategy would involve more considerations, but this accurately reflects the core functionality.
24 / 30
David: "Our team is debating whether to continue using the traditional sidecar model for our service mesh or migrate to ambient mesh. What's the primary advantage of ambient mesh?"This question focuses on a key trade-off between service mesh architectures. Ambient mesh's primary advantage is reduced operational overhead – the elimination of sidecar proxies significantly simplifies deployment and reduces resource consumption. The other options misrepresent the benefits or introduce incorrect assumptions about performance, security, or control.
25 / 30
Eve: "I'm deploying a new microservice and need to integrate it into our existing service mesh. I've configured the mTLS policies correctly, but I'm getting intermittent connection errors. I suspect there might be an issue with Envoy's probe configuration."This scenario tests understanding of Envoy probe configuration within a service mesh. Envoy probes are crucial for monitoring service health and influencing traffic routing decisions. A misconfigured probe can indeed lead to intermittent connection errors, highlighting the importance of proper configuration.
26 / 30
Alice: "Hey, I'm seeing a lot of latency spikes when our backend service, OrderService, calls the PaymentGateway. I've checked the database and network, but nothing obvious. I was thinking about using Envoy rules to prioritize traffic based on service health. Does this align with how service meshes typically handle these kinds of issues?"This question tests understanding of Envoy's role within a service mesh. The core concept is that service meshes provide *dynamic* routing and policy enforcement – this is precisely what Envoy does. A correct answer recognizes this capability, while the other options misinterpret Envoy's function or suggest it solves underlying problems outside its scope.
27 / 30
Ben (in a Slack channel): "I'm trying to understand how service mesh traffic management works. I keep hearing about 'traffic shadowing'. What does that actually mean?"The correct answer accurately describes traffic shadowing – it's about mirroring traffic for observation and control. The other options present common service mesh concepts (debugging, load balancing, security) but don't capture the specific meaning of traffic shadowing. This tests a precise vocabulary point.
28 / 30
Charlie (in a PR description): "Implemented mTLS for all outbound traffic from the UserAuthService. This will ensure secure communication with downstream services and prevent man-in-the-middle attacks. We've also configured Envoy to automatically handle certificate rotation."The question assesses the understanding of how mTLS fits into a service mesh. The description correctly highlights the combination of automated certificate rotation and mTLS as a best practice for secure communication. It's important to recognize that this is a *simplified* view – a full security strategy would involve more considerations, but this accurately reflects the core functionality.
29 / 30
David: "Our team is debating whether to continue using the traditional sidecar model for our service mesh or migrate to ambient mesh. What's the primary advantage of ambient mesh?"This question focuses on a key trade-off between service mesh architectures. Ambient mesh's primary advantage is reduced operational overhead – the elimination of sidecar proxies significantly simplifies deployment and reduces resource consumption. The other options misrepresent the benefits or introduce incorrect assumptions about performance, security, or control.
30 / 30
Eve: "I'm deploying a new microservice and need to integrate it into our existing service mesh. I've configured the mTLS policies correctly, but I'm getting intermittent connection errors. I suspect there might be an issue with Envoy's probe configuration."This scenario tests understanding of Envoy probe configuration within a service mesh. Envoy probes are crucial for monitoring service health and influencing traffic routing decisions. A misconfigured probe can indeed lead to intermittent connection errors, highlighting the importance of proper configuration.
Frequently Asked Questions
What will I learn from the "Service Mesh Fundamentals — Vocabulary — Service Mesh Operations | CoderLingo" exercise?
5 exercises practising the core vocabulary of service meshes — data plane, control plane, sidecar proxies, and Istio architecture.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 30 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Service Mesh Operations Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss service mesh operations language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 30 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Service Mesh Operations Language exercises?
See the full Service Mesh Operations Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.