Sidecar proxy (Envoy): injected by Kubernetes MutatingAdmissionWebhook into pods in labeled namespaces. An init container sets up iptables rules to redirect all traffic through Envoy. The app connects to localhost; Envoy intercepts and proxies. Benefits: app is unchanged, gets mTLS, distributed tracing, metrics, retries, circuit breaking "for free". Cost: two containers per pod (~50-100MB RAM each), ~0.5ms added latency per proxy hop. Ambient mode (Istio 2023+): moves L4 to per-node ztunnel, eliminating per-pod sidecars while keeping L7 via optional Waypoint proxies.
2 / 5
What is mTLS in a service mesh and what does it prevent?
mTLS: standard TLS proves server identity to client. mTLS proves both. Istio Citadel (now part of istiod) acts as a CA, issuing SPIFFE SVIDs (certificates) to each pod based on its Kubernetes service account. SPIFFE ID: spiffe://cluster.local/ns/default/sa/payments. PeerAuthentication: STRICT (only mTLS connections accepted) or PERMISSIVE (transition mode). AuthorizationPolicy: "allow traffic to payments service only from the checkout service account, on path /api/charge". This is zero-trust inside the cluster.
3 / 5
In Istio, what does a VirtualService control?
VirtualService: attaches to a service's hostname. Defines routing rules evaluated by the Envoy sidecar when routing requests to the service. Key features: Weight-based routing: 90% → v1, 10% → v2 (canary). Header match: route requests with X-Canary: true to v2. Retry policy: retry on 5xx, 3 attempts, 25ms between. Timeout: fail after 500ms. Fault injection: inject artificial 5xx or delay — test resilience. DestinationRule: defines subsets (pod groups by label), load balancing policy (round robin, consistent hash), circuit breaker (outlier detection), and TLS settings per subset.
4 / 5
What is outlier detection in Istio's circuit breaking?
Outlier detection: configured in DestinationRule.trafficPolicy. Key settings: consecutiveGatewayErrors: 5 — eject after 5 consecutive 5xx. interval: 30s — evaluation window. baseEjectionTime: 30s — minimum ejection duration (doubles on each ejection). maxEjectionPercent: 50 — prevent ejecting majority of endpoints. Works at individual endpoint (pod IP) level — not service level. Complements retry policy: retry sends to any available endpoint; outlier detection removes known-bad endpoints from the pool entirely.
5 / 5
What is the data plane vs control plane split in Istio?
Data plane (Envoy sidecars): intercepts all traffic, enforces policy, collects telemetry, performs mTLS. Runs in the application pods. Control plane (istiod): components: Pilot (converts Istio CRs to xDS config), Citadel (CA for certificates), Galley (config validation). Uses xDS API (Envoy's discovery service) to push configuration to proxies: LDS (listener), RDS (route), CDS (cluster), EDS (endpoint). Configuration changes propagate to proxies within seconds. The control plane is relatively small (one istiod pod per cluster) while the data plane scales with your pods.
What does the "Service Mesh with Istio" vocabulary exercise cover?
This exercise tests real IT vocabulary related to service mesh with istio through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — browse the full vocabulary exercises hub to find related modules covering adjacent IT topics and roles.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.