Advanced
Service Mesh
#virtualservice#destinationrule#canary
Traffic Management Policies — Vocabulary
5 exercises — 5 exercises practising Istio traffic management vocabulary — VirtualService, DestinationRule, canary routing, and traffic shifting language.
0 / 30 completed
1 / 30
Your team is deploying a new version of the checkout service. You want to send 10% of traffic to v2 and 90% to v1 without changing DNS or redeploying. Which Istio resources do you need, and how would you describe the setup?
Istio canary releases require two resources working together: VirtualService (where traffic goes, with weights) and DestinationRule (which pods each subset refers to).
The VirtualService controls routing decisions — it says "send 90% to the v1 subset and 10% to the v2 subset." The DestinationRule defines what those subsets are — it maps subset name v1 to pods matching the label version: v1. Without the DestinationRule, the VirtualService has no way to distinguish v1 pods from v2 pods. Changing the canary percentage is a simple config update to the VirtualService weights — no redeployment required.
Key vocabulary:
• VirtualService weight — integer 0-100 controlling traffic proportion; all weights in a route must sum to 100
• DestinationRule subset — named group defined by pod label selectors
• canary deployment (via mesh) — gradual traffic shifting using weights; differs from canary via replica count
The VirtualService controls routing decisions — it says "send 90% to the v1 subset and 10% to the v2 subset." The DestinationRule defines what those subsets are — it maps subset name v1 to pods matching the label version: v1. Without the DestinationRule, the VirtualService has no way to distinguish v1 pods from v2 pods. Changing the canary percentage is a simple config update to the VirtualService weights — no redeployment required.
Key vocabulary:
• VirtualService weight — integer 0-100 controlling traffic proportion; all weights in a route must sum to 100
• DestinationRule subset — named group defined by pod label selectors
• canary deployment (via mesh) — gradual traffic shifting using weights; differs from canary via replica count
2 / 30
A developer asks: "What does outlier detection in a DestinationRule do?" Which answer is most accurate?
Outlier detection is Istio's circuit breaker for individual pod instances — it ejects unhealthy pods from the load balancing pool without requiring application code changes.
Configured in the DestinationRule's trafficPolicy.outlierDetection field, common settings include: consecutiveGatewayErrors (eject after N consecutive 5xx responses), interval (how often to check), baseEjectionTime (initial ejection duration), and maxEjectionPercent (maximum fraction of pods that can be ejected simultaneously — prevents ejecting all pods). After the ejection duration, the pod is re-admitted and gradually receives traffic again.
Key vocabulary:
• outlier detection — the Istio name for per-instance circuit breaking; ejects unhealthy pods from LB pool
• ejection — temporarily removing a pod from the load balancing rotation
• consecutiveGatewayErrors — number of consecutive 5xx/connection failures before ejection
Configured in the DestinationRule's trafficPolicy.outlierDetection field, common settings include: consecutiveGatewayErrors (eject after N consecutive 5xx responses), interval (how often to check), baseEjectionTime (initial ejection duration), and maxEjectionPercent (maximum fraction of pods that can be ejected simultaneously — prevents ejecting all pods). After the ejection duration, the pod is re-admitted and gradually receives traffic again.
Key vocabulary:
• outlier detection — the Istio name for per-instance circuit breaking; ejects unhealthy pods from LB pool
• ejection — temporarily removing a pod from the load balancing rotation
• consecutiveGatewayErrors — number of consecutive 5xx/connection failures before ejection
3 / 30
A teammate describes a scenario: "We need to route all requests with the header x-beta-user: true to the v2 backend, and all other requests to v1." What is the correct Istio term for this capability?
Header-based routing in a VirtualService allows targeting specific users (e.g., beta users, QA team) to a new version without percentage-based traffic splitting.
The VirtualService match block can specify exact, prefix, or regex matches on any HTTP header. Requests matching x-beta-user: true are routed to the v2 subset; all other requests hit the default route to v1. This is commonly used for: internal QA testing (route requests from internal IP or with a header), canary for specific users (route a opted-in user cohort), and feature testing (the frontend sends a header when a feature flag is on).
Key vocabulary:
• header-based routing — VirtualService match on HTTP header value; enables targeted rollouts
• match condition — VirtualService field specifying when a route rule applies (headers, URI, method)
• default route — the catch-all route with no match conditions; applied when no match rule fires
The VirtualService match block can specify exact, prefix, or regex matches on any HTTP header. Requests matching x-beta-user: true are routed to the v2 subset; all other requests hit the default route to v1. This is commonly used for: internal QA testing (route requests from internal IP or with a header), canary for specific users (route a opted-in user cohort), and feature testing (the frontend sends a header when a feature flag is on).
Key vocabulary:
• header-based routing — VirtualService match on HTTP header value; enables targeted rollouts
• match condition — VirtualService field specifying when a route rule applies (headers, URI, method)
• default route — the catch-all route with no match conditions; applied when no match rule fires
4 / 30
You are explaining fault injection in Istio to a QA engineer. Which description is correct?
Fault injection via VirtualService is a powerful resilience testing tool — inject delays or errors into a specific service without touching any code or infrastructure.
Two types of faults can be injected: (1) delay — adds an artificial latency (e.g., 500ms) to a percentage of requests, testing timeout handling; (2) abort — returns an HTTP error code (e.g., 503) for a percentage of requests, testing error handling and circuit breakers. The fault is configured in the VirtualService for the destination service. Use case: inject a 2-second delay on 50% of calls to payment-service and verify the order-service correctly times out and returns a degraded response rather than hanging indefinitely.
Key vocabulary:
• fault injection — VirtualService feature adding artificial delays or HTTP errors to test resilience
• delay fault — adds latency; tests timeout configuration in upstream services
• abort fault — returns error HTTP status; tests error handling and fallback logic
Two types of faults can be injected: (1) delay — adds an artificial latency (e.g., 500ms) to a percentage of requests, testing timeout handling; (2) abort — returns an HTTP error code (e.g., 503) for a percentage of requests, testing error handling and circuit breakers. The fault is configured in the VirtualService for the destination service. Use case: inject a 2-second delay on 50% of calls to payment-service and verify the order-service correctly times out and returns a degraded response rather than hanging indefinitely.
Key vocabulary:
• fault injection — VirtualService feature adding artificial delays or HTTP errors to test resilience
• delay fault — adds latency; tests timeout configuration in upstream services
• abort fault — returns error HTTP status; tests error handling and fallback logic
5 / 30
A platform engineer explains: "We configure retry policies in the mesh rather than in application code." Where in Istio is a retry policy configured, and what does it control?
VirtualService retry policies let you define retry behaviour at the mesh level — the calling service never knows a retry happened.
A VirtualService retries block typically specifies: attempts (max retry count), perTryTimeout (timeout for each individual attempt), retryOn (comma-separated conditions: 5xx, gateway-error, connect-failure, retriable-4xx). Envoy handles the retries transparently. This is powerful for transient failures: a 502 from a briefly-restarting pod can be retried once without the caller experiencing an error. Important: only retry idempotent requests (GET, DELETE with no side effects) or requests with idempotency keys to avoid duplicate writes.
Key vocabulary:
• VirtualService retries — mesh-level retry config; retries happen in Envoy, invisible to the calling service
• retryOn — condition list triggering retries (5xx, gateway-error, connect-failure)
• perTryTimeout — timeout per attempt; total budget = attempts × perTryTimeout
A VirtualService retries block typically specifies: attempts (max retry count), perTryTimeout (timeout for each individual attempt), retryOn (comma-separated conditions: 5xx, gateway-error, connect-failure, retriable-4xx). Envoy handles the retries transparently. This is powerful for transient failures: a 502 from a briefly-restarting pod can be retried once without the caller experiencing an error. Important: only retry idempotent requests (GET, DELETE with no side effects) or requests with idempotency keys to avoid duplicate writes.
Key vocabulary:
• VirtualService retries — mesh-level retry config; retries happen in Envoy, invisible to the calling service
• retryOn — condition list triggering retries (5xx, gateway-error, connect-failure)
• perTryTimeout — timeout per attempt; total budget = attempts × perTryTimeout
6 / 30
Alex: "Hey team, we're using Istio to manage traffic to our new payment service. We need to ensure that if a request fails on the v2 backend (due to temporary issues), it's automatically retried three times before being marked as failed. How would you configure this within Istio?"DestinationRules are used for traffic management based on various criteria. The
HTTP_RETRY policy within a DestinationRule specifically controls retry behavior for HTTP requests. Options A and B accurately describe how to configure this functionality using Istio resources. Option C is incorrect because application-level retries bypass Istio's mesh control, and option D describes fault injection, not configuring retry policies.7 / 30
Sarah (a junior dev) asks: "I'm seeing a message in the logs about 'Service Mesh Connectivity Issues'. What does this typically indicate?"'Service Mesh Connectivity Issues' often points to problems *within* the Istio service mesh. Istio manages communication between services using Envoy proxies and relies on features like mutual TLS (mTLS) and traffic routing. The message suggests a configuration error or operational issue within Istio's control plane or proxy instances, rather than a problem with the underlying network or application code itself. Options A and B are potential causes but not the primary meaning of the message.
8 / 30
Ben (a platform engineer) is writing a PR description for a change to the traffic management policy for the user authentication service: "We are implementing a canary release strategy using Istio's features. We will route 10% of new user requests to the v3 version of the service, and monitor its performance before gradually increasing the percentage over time.". Which command is most appropriate to achieve this?"Istio's
VirtualService resources provide granular control over traffic routing. A weighted traffic split allows for a canary release by directing a percentage of requests to the new version (v3) while maintaining the existing version(s). Option B is partially correct but doesn't offer the dynamic, controlled rollout required for a canary deployment; option D is incorrect and represents a traditional DNS-based approach. Option A accurately describes the configuration needed in Istio.9 / 30
Chloe: "I'm investigating slow response times for a service. I've checked the Envoy logs and see messages related to 'request timeouts'. What is the most likely cause?"'Request timeouts' within Istio (and Envoy) typically indicate that a service is not responding within the defined timeframe. This often happens when the backend service itself is slow or unavailable – even if the network connection is healthy. Option A acknowledges that application inefficiency *could* be a factor, but isn't directly reflected in the log messages. Options B and C are possible contributing factors, but the core issue being reported is the timeout itself.
10 / 30
David (a senior dev) says: "We're using Istio to implement circuit breaking. This prevents cascading failures by automatically stopping requests to a failing service.". Where is the circuit break configuration typically defined, and what key property controls its behavior?"Circuit breaking is configured using
EnvoyFilter resources which define specific Envoy proxy behaviors. The key property controlling the behavior of the circuit breaker is the circuitBreaker setting within this resource, allowing you to dynamically manage request routing based on failure thresholds. Options A and B are incorrect as they relate to traffic management rather than fault tolerance.11 / 30
Alex: "Hey team, we're using Istio to manage traffic to our new payment service. We need to ensure that if a request fails on the v2 backend (due to temporary issues), it's automatically retried three times before being marked as failed. How would you configure this within Istio?"DestinationRules are used for traffic management based on various criteria. The
HTTP_RETRY policy within a DestinationRule specifically controls retry behavior for HTTP requests. Options A and B accurately describe how to configure this functionality using Istio resources. Option C is incorrect because application-level retries bypass Istio's mesh control, and option D describes fault injection, not configuring retry policies.12 / 30
Sarah (a junior dev) asks: "I'm seeing a message in the logs about 'Service Mesh Connectivity Issues'. What does this typically indicate?"'Service Mesh Connectivity Issues' often points to problems *within* the Istio service mesh. Istio manages communication between services using Envoy proxies and relies on features like mutual TLS (mTLS) and traffic routing. The message suggests a configuration error or operational issue within Istio's control plane or proxy instances, rather than a problem with the underlying network or application code itself. Options A and B are potential causes but not the primary meaning of the message.
13 / 30
Ben (a platform engineer) is writing a PR description for a change to the traffic management policy for the user authentication service: "We are implementing a canary release strategy using Istio's features. We will route 10% of new user requests to the v3 version of the service, and monitor its performance before gradually increasing the percentage over time.". Which command is most appropriate to achieve this?"Istio's
VirtualService resources provide granular control over traffic routing. A weighted traffic split allows for a canary release by directing a percentage of requests to the new version (v3) while maintaining the existing version(s). Option B is partially correct but doesn't offer the dynamic, controlled rollout required for a canary deployment; option D is incorrect and represents a traditional DNS-based approach. Option A accurately describes the configuration needed in Istio.14 / 30
Chloe: "I'm investigating slow response times for a service. I've checked the Envoy logs and see messages related to 'request timeouts'. What is the most likely cause?"'Request timeouts' within Istio (and Envoy) typically indicate that a service is not responding within the defined timeframe. This often happens when the backend service itself is slow or unavailable – even if the network connection is healthy. Option A acknowledges that application inefficiency *could* be a factor, but isn't directly reflected in the log messages. Options B and C are possible contributing factors, but the core issue being reported is the timeout itself.
15 / 30
David (a senior dev) says: "We're using Istio to implement circuit breaking. This prevents cascading failures by automatically stopping requests to a failing service.". Where is the circuit break configuration typically defined, and what key property controls its behavior?"Circuit breaking is configured using
EnvoyFilter resources which define specific Envoy proxy behaviors. The key property controlling the behavior of the circuit breaker is the circuitBreaker setting within this resource, allowing you to dynamically manage request routing based on failure thresholds. Options A and B are incorrect as they relate to traffic management rather than fault tolerance.16 / 30
Alex: "Hey team, we're using Istio to manage traffic to our new payment service. We need to ensure that if a request fails on the v2 backend (due to temporary issues), it's automatically retried three times before being marked as failed. How would you configure this within Istio?"DestinationRules are used for traffic management based on various criteria. The
HTTP_RETRY policy within a DestinationRule specifically controls retry behavior for HTTP requests. Options A and B accurately describe how to configure this functionality using Istio resources. Option C is incorrect because application-level retries bypass Istio's mesh control, and option D describes fault injection, not configuring retry policies.17 / 30
Sarah (a junior dev) asks: "I'm seeing a message in the logs about 'Service Mesh Connectivity Issues'. What does this typically indicate?"'Service Mesh Connectivity Issues' often points to problems *within* the Istio service mesh. Istio manages communication between services using Envoy proxies and relies on features like mutual TLS (mTLS) and traffic routing. The message suggests a configuration error or operational issue within Istio's control plane or proxy instances, rather than a problem with the underlying network or application code itself. Options A and B are potential causes but not the primary meaning of the message.
18 / 30
Ben (a platform engineer) is writing a PR description for a change to the traffic management policy for the user authentication service: "We are implementing a canary release strategy using Istio's features. We will route 10% of new user requests to the v3 version of the service, and monitor its performance before gradually increasing the percentage over time.". Which command is most appropriate to achieve this?"Istio's
VirtualService resources provide granular control over traffic routing. A weighted traffic split allows for a canary release by directing a percentage of requests to the new version (v3) while maintaining the existing version(s). Option B is partially correct but doesn't offer the dynamic, controlled rollout required for a canary deployment; option D is incorrect and represents a traditional DNS-based approach. Option A accurately describes the configuration needed in Istio.19 / 30
Chloe: "I'm investigating slow response times for a service. I've checked the Envoy logs and see messages related to 'request timeouts'. What is the most likely cause?"'Request timeouts' within Istio (and Envoy) typically indicate that a service is not responding within the defined timeframe. This often happens when the backend service itself is slow or unavailable – even if the network connection is healthy. Option A acknowledges that application inefficiency *could* be a factor, but isn't directly reflected in the log messages. Options B and C are possible contributing factors, but the core issue being reported is the timeout itself.
20 / 30
David (a senior dev) says: "We're using Istio to implement circuit breaking. This prevents cascading failures by automatically stopping requests to a failing service.". Where is the circuit break configuration typically defined, and what key property controls its behavior?"Circuit breaking is configured using
EnvoyFilter resources which define specific Envoy proxy behaviors. The key property controlling the behavior of the circuit breaker is the circuitBreaker setting within this resource, allowing you to dynamically manage request routing based on failure thresholds. Options A and B are incorrect as they relate to traffic management rather than fault tolerance.21 / 30
Alex: "Hey team, we're using Istio to manage traffic to our new payment service. We need to ensure that if a request fails on the v2 backend (due to temporary issues), it's automatically retried three times before being marked as failed. How would you configure this within Istio?"DestinationRules are used for traffic management based on various criteria. The
HTTP_RETRY policy within a DestinationRule specifically controls retry behavior for HTTP requests. Options A and B accurately describe how to configure this functionality using Istio resources. Option C is incorrect because application-level retries bypass Istio's mesh control, and option D describes fault injection, not configuring retry policies.22 / 30
Sarah (a junior dev) asks: "I'm seeing a message in the logs about 'Service Mesh Connectivity Issues'. What does this typically indicate?"'Service Mesh Connectivity Issues' often points to problems *within* the Istio service mesh. Istio manages communication between services using Envoy proxies and relies on features like mutual TLS (mTLS) and traffic routing. The message suggests a configuration error or operational issue within Istio's control plane or proxy instances, rather than a problem with the underlying network or application code itself. Options A and B are potential causes but not the primary meaning of the message.
23 / 30
Ben (a platform engineer) is writing a PR description for a change to the traffic management policy for the user authentication service: "We are implementing a canary release strategy using Istio's features. We will route 10% of new user requests to the v3 version of the service, and monitor its performance before gradually increasing the percentage over time.". Which command is most appropriate to achieve this?"Istio's
VirtualService resources provide granular control over traffic routing. A weighted traffic split allows for a canary release by directing a percentage of requests to the new version (v3) while maintaining the existing version(s). Option B is partially correct but doesn't offer the dynamic, controlled rollout required for a canary deployment; option D is incorrect and represents a traditional DNS-based approach. Option A accurately describes the configuration needed in Istio.24 / 30
Chloe: "I'm investigating slow response times for a service. I've checked the Envoy logs and see messages related to 'request timeouts'. What is the most likely cause?"'Request timeouts' within Istio (and Envoy) typically indicate that a service is not responding within the defined timeframe. This often happens when the backend service itself is slow or unavailable – even if the network connection is healthy. Option A acknowledges that application inefficiency *could* be a factor, but isn't directly reflected in the log messages. Options B and C are possible contributing factors, but the core issue being reported is the timeout itself.
25 / 30
David (a senior dev) says: "We're using Istio to implement circuit breaking. This prevents cascading failures by automatically stopping requests to a failing service.". Where is the circuit break configuration typically defined, and what key property controls its behavior?"Circuit breaking is configured using
EnvoyFilter resources which define specific Envoy proxy behaviors. The key property controlling the behavior of the circuit breaker is the circuitBreaker setting within this resource, allowing you to dynamically manage request routing based on failure thresholds. Options A and B are incorrect as they relate to traffic management rather than fault tolerance.26 / 30
Alex: "Hey team, we're using Istio to manage traffic to our new payment service. We need to ensure that if a request fails on the v2 backend (due to temporary issues), it's automatically retried three times before being marked as failed. How would you configure this within Istio?"DestinationRules are used for traffic management based on various criteria. The
HTTP_RETRY policy within a DestinationRule specifically controls retry behavior for HTTP requests. Options A and B accurately describe how to configure this functionality using Istio resources. Option C is incorrect because application-level retries bypass Istio's mesh control, and option D describes fault injection, not configuring retry policies.27 / 30
Sarah (a junior dev) asks: "I'm seeing a message in the logs about 'Service Mesh Connectivity Issues'. What does this typically indicate?"'Service Mesh Connectivity Issues' often points to problems *within* the Istio service mesh. Istio manages communication between services using Envoy proxies and relies on features like mutual TLS (mTLS) and traffic routing. The message suggests a configuration error or operational issue within Istio's control plane or proxy instances, rather than a problem with the underlying network or application code itself. Options A and B are potential causes but not the primary meaning of the message.
28 / 30
Ben (a platform engineer) is writing a PR description for a change to the traffic management policy for the user authentication service: "We are implementing a canary release strategy using Istio's features. We will route 10% of new user requests to the v3 version of the service, and monitor its performance before gradually increasing the percentage over time.". Which command is most appropriate to achieve this?"Istio's
VirtualService resources provide granular control over traffic routing. A weighted traffic split allows for a canary release by directing a percentage of requests to the new version (v3) while maintaining the existing version(s). Option B is partially correct but doesn't offer the dynamic, controlled rollout required for a canary deployment; option D is incorrect and represents a traditional DNS-based approach. Option A accurately describes the configuration needed in Istio.29 / 30
Chloe: "I'm investigating slow response times for a service. I've checked the Envoy logs and see messages related to 'request timeouts'. What is the most likely cause?"'Request timeouts' within Istio (and Envoy) typically indicate that a service is not responding within the defined timeframe. This often happens when the backend service itself is slow or unavailable – even if the network connection is healthy. Option A acknowledges that application inefficiency *could* be a factor, but isn't directly reflected in the log messages. Options B and C are possible contributing factors, but the core issue being reported is the timeout itself.
30 / 30
David (a senior dev) says: "We're using Istio to implement circuit breaking. This prevents cascading failures by automatically stopping requests to a failing service.". Where is the circuit break configuration typically defined, and what key property controls its behavior?"Circuit breaking is configured using
EnvoyFilter resources which define specific Envoy proxy behaviors. The key property controlling the behavior of the circuit breaker is the circuitBreaker setting within this resource, allowing you to dynamically manage request routing based on failure thresholds. Options A and B are incorrect as they relate to traffic management rather than fault tolerance.Frequently Asked Questions
What will I learn from the "Traffic Management Policies — Vocabulary — Service Mesh Operations | CoderLingo" exercise?
5 exercises practising Istio traffic management vocabulary — VirtualService, DestinationRule, canary routing, and traffic shifting language.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 30 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Service Mesh Operations Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss service mesh operations language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 30 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Service Mesh Operations Language exercises?
See the full Service Mesh Operations Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.