Istio Certified Associate cheat sheet

istioctl install --set profile=demo deploys the demo profile; profiles are minimal, default, demo, empty, ambient, and remote, each selecting different components.

The IstioOperator CR (kind: IstioOperator, apiVersion install.istio.io/v1alpha1) is the declarative install input; istioctl install -f file.yaml applies it, and istioctl profile dump <name> prints the effective values.

Revision-based installs (--set revision=canary) let multiple control planes coexist; namespace label istio-injection=enabled selects the default revision, while istio.io/rev=<revision> pins a specific one.

Sidecar injection requires the mutating webhook istio-sidecar-injector; the label sidecar.istio.io/inject=false on a pod or namespace overrides namespace-level injection.

istioctl x precheck validates cluster compatibility before install; istioctl analyze reports configuration issues (e.g., conflicting gateways, missing service ports) without changing the cluster.

Upgrade flow for in-place: istioctl upgrade (or install a new revision, migrate namespaces via relabeling, then istioctl tag set default --revision <new> and remove the old revision).

Canary upgrade steps: install new revision, relabel a test namespace to the new revision, restart pods, validate with istioctl proxy-status and proxy-config, then move remaining namespaces.

istioctl manifest generate produces the raw Kubernetes YAML for GitOps; istioctl verify-install compares a live cluster against a manifest to confirm the install matches.

The meshConfig block in IstioOperator sets global behavior: accessLogFile, defaultConfig.holdApplicationUntilProxyStarts, enableAutoMtls, and outboundTrafficPolicy.mode (ALLOW_ANY vs REGISTRY_ONLY).

VirtualService routes traffic to a host using http/tcp/tls match rules; destination.host must reference a Kubernetes Service or ServiceEntry registered in the mesh.

DestinationRule defines subsets (label selectors on pod labels), load balancing (ROUND_ROBIN, LEAST_REQUEST, RANDOM, PASSTHROUGH), connection pool, and outlier detection for a host.

Traffic splitting for canary: two http routes with weight values that must sum to 100, each pointing at a distinct subset defined in a DestinationRule.

Match conditions include uri (exact, prefix, regex), headers, method, queryParams, and sourceLabels; the first matching route wins, so order routes from most to least specific.

Gateway resources (networking.istio.io/v1) configure the ingress/egress Envoy listeners with hosts, port, protocol, and tls; a VirtualService binds to it via gateways: [name] and hosts.

VirtualService.hosts: ['*'] with a bound gateway acts as a catch-all; without gateways, the VirtualService applies to sidecars inside the mesh only.

Fault injection uses fault.delay (fixed or exponential) and fault.abort (HTTP status); a percentage value limits the fault to a fraction of requests.

Retries are set per route with retries: {attempts, perTryTimeout, retryOn}; timeouts use timeout on the route and default to 15s when unset.

ServiceEntry adds external or unregistered hosts to the mesh registry; resolution is NONE, STATIC, DNS, or DNS_ROUND_ROBIN, and location is MESH_EXTERNAL or MESH_INTERNAL.

PeerAuthentication mtls.mode values: STRICT, PERMISSIVE, DISABLE, and UNSET (inherit from mesh); mesh-wide policy lives in the root namespace (istio-system) with no selector.

Auto mTLS is enabled when meshConfig.enableAutoMtls=true (default); sidecars then send mTLS to workloads that have sidecars and plaintext to those that do not.

RequestAuthentication validates JWTs via jwtRules (issuer, jwksUri or jwks, audiences); it rejects invalid tokens but does not require one - pair with AuthorizationPolicy for enforcement.

AuthorizationPolicy actions are ALLOW, DENY, and CUSTOM; an empty spec with action ALLOW in a namespace denies all requests to that namespace's workloads.

AuthorizationPolicy rules combine from (source: principals, namespaces, ipBlocks) and to (operation: methods, paths, hosts); all conditions within a rule are ANDed, rules are ORed.

Principal format for mTLS identities is <trustDomain>/ns/<namespace>/sa/<serviceaccount>, e.g. cluster.local/ns/default/sa/frontend.

jwksUri must be reachable by the control plane for JWT validation; requestPrincipals in an AuthorizationPolicy matches the iss/sub claim pair of a validated token.

DNS certificate provisioning for gateways uses dnsNames in the Gateway tls block with credentialName; the istiod DNS agent writes the resulting secret into the gateway namespace.

istioctl proxy-status shows SYNCED/STALE/NOT SENT per proxy; STALE means the proxy has not ACKed the latest config, NOT SENT means istiod has not pushed it.

istioctl analyze -n <ns> reports validation errors and warnings; exit code 1 indicates issues, making it usable in CI pipelines.

istioctl proxy-config cluster|listener|route|endpoint <pod> inspects Envoy config; endpoint reveals whether the proxy sees healthy upstream pod IPs.

istioctl dashboard opens Kiali, Grafana, Jaeger, or Envoy admin; the Envoy admin interface is also reachable on port 15000 inside the sidecar.

Sidecar ports: 15000 (Envoy admin), 15001 (outbound listener), 15006 (inbound listener), 15020 (merged Prometheus stats), 15021 (health checks), 15090 (Envoy Prometheus stats).

If a pod fails to start with injection enabled, check that the istio-sidecar-injector webhook is present, the namespace label matches a revision, and the istiod service has ready endpoints.

503 UF (upstream failure) usually means no healthy endpoints or a bad DestinationRule subset; 503 NR (no route) means no VirtualService route matched the request.

istioctl proxy-config log <pod> --level debug raises Envoy log verbosity; istioctl x es (or istioctl experimental) exposes internal debug endpoints for xDS and injection.

istioctl bug-report collects cluster state, proxy configs, and logs into a tarball for offline analysis; istioctl version confirms client, control plane, and data plane versions match.