Istio Certified Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IstioOperator resource

Declarative CR of kind IstioOperator (install.istio.io/v1alpha1) that describes the desired Istio installation, including profile, components, and meshConfig; applied with istioctl install -f.

Istio configuration profiles

Named presets (minimal, default, demo, empty, ambient, remote) that select which components are installed and their settings; chosen with --set profile=<name> or overridden in IstioOperator.

Revision-based installation

Installing a control plane with a unique revision label so multiple istiod versions coexist; namespaces select a revision via the istio.io/rev label instead of istio-injection.

istioctl x precheck

Command that validates cluster prerequisites such as Kubernetes version and existing Istio installations before running install or upgrade, reporting blocking issues without modifying the cluster.

Canary control plane upgrade

Install a new revision alongside the old one, relabel selected namespaces to the new revision, restart their pods, validate, then migrate remaining namespaces and remove the old revision.

istioctl manifest generate

Renders the full Kubernetes YAML for an installation without applying it, enabling GitOps workflows and offline review; verify-install can compare output to a live cluster.

Sidecar injection label

Namespace label istio-injection=enabled enables injection for the default revision; istio.io/rev=<revision> selects a specific revision; pod annotation sidecar.istio.io/inject=false disables it.

VirtualService routing

Resource that matches requests by uri, headers, method, or source labels and forwards them to destination hosts and subsets, with optional weights, timeouts, retries, and fault injection.

DestinationRule subsets

Named groups within a DestinationRule that select pods by label, allowing VirtualService routes to target specific versions for canary or blue-green traffic splitting.

Traffic weight splitting

Two or more http routes in a VirtualService with weight fields summing to 100 distribute requests across DestinationRule subsets for gradual rollouts.

Gateway resource

Configures an Envoy ingress or egress listener with hosts, ports, protocol, and optional TLS settings; VirtualServices attach to it by name to expose routes outside the mesh.

Fault injection

VirtualService fault block that introduces delay or abort (HTTP status) for a percentage of requests, used to test resilience without changing application code.

Route retries and timeouts

Per-route settings: retries specify attempts, perTryTimeout, and retryOn conditions; timeout caps total request duration and defaults to 15 seconds when omitted.

ServiceEntry

Adds external or unregistered hosts to the mesh service registry, specifying hosts, addresses, ports, resolution (NONE, STATIC, DNS, DNS_ROUND_ROBIN), and location.

Outbound traffic policy

meshConfig.outboundTrafficPolicy.mode set to ALLOW_ANY (unknown egress allowed) or REGISTRY_ONLY (only hosts in the registry are reachable), controlling egress behavior.

Load balancing algorithms

DestinationRule trafficPolicy.loadBalancer options: ROUND_ROBIN (default), LEAST_REQUEST, RANDOM, and PASSTHROUGH, applied per host or per subset.

PeerAuthentication STRICT mode

Policy requiring mTLS for all traffic to selected workloads; plaintext connections are rejected. Set mesh-wide in the root namespace without a selector, or per namespace or workload.

PERMISSIVE mTLS mode

PeerAuthentication mode accepting both mTLS and plaintext traffic, used during migration to mTLS; it does not enforce encryption, so STRICT is needed for zero-trust guarantees.

Auto mTLS

Feature enabled by meshConfig.enableAutoMtls that makes sidecars automatically use mTLS toward workloads with sidecars and plaintext toward those without.

RequestAuthentication

Policy validating JWTs against issuer, jwksUri, and audiences; invalid tokens are rejected but missing tokens pass, so pair it with AuthorizationPolicy to require authentication.

AuthorizationPolicy ALLOW action

Permits requests matching its rules and denies all others for the targeted workloads; an empty spec with ALLOW in a namespace blocks every request to that namespace's workloads.

AuthorizationPolicy DENY action

Blocks requests matching the rules while allowing everything else; DENY policies are evaluated before ALLOW policies, so an explicit deny cannot be overridden by an allow.

Service account principal format

mTLS identity string of the form <trustDomain>/ns/<namespace>/sa/<serviceaccount>, such as cluster.local/ns/default/sa/frontend, used in AuthorizationPolicy source principals.

requestPrincipals matching

AuthorizationPolicy field matching the iss/sub pair of a validated JWT, e.g. iss#sub, enabling per-client authorization based on token claims rather than workload identity.

istioctl proxy-status

Reports each proxy's configuration sync state: SYNCED, STALE (proxy not acknowledging latest config), or NOT SENT (istiod has not pushed config), plus the istiod instance serving it.

istioctl analyze

Static analysis of mesh configuration that reports validation errors and warnings such as conflicting gateways or missing ports; nonzero exit code makes it suitable for CI checks.

istioctl proxy-config

Subcommands cluster, listener, route, endpoint, and secret dump a specific proxy's Envoy configuration, used to verify that routes and healthy endpoints were pushed correctly.

Sidecar port numbers

Envoy admin 15000, outbound listener 15001, inbound listener 15006, merged Prometheus stats 15020, health checks 15021, and Envoy Prometheus stats 15090.

503 UF response

Upstream failure code meaning Envoy found no healthy endpoints for the destination, often caused by a DestinationRule subset label mismatch or failing readiness probes.

503 NR response

No route code meaning no VirtualService route matched the request host, path, or headers, or the VirtualService is not bound to the gateway handling the traffic.

istioctl bug-report

Collects cluster state, Istio configuration, proxy configs, and logs into a tarball for offline diagnosis; useful when dashboards and live commands are unavailable.

Envoy log level tuning

istioctl proxy-config log <pod> --level debug raises verbosity for a specific Envoy component, then traffic is replayed to capture detailed routing or TLS failure messages.