Istio Certified Associate: Traffic Management

What this domain tests

Traffic Management tests how you expose, route, split, and protect traffic using Gateway, VirtualService, and DestinationRule. Expect subsets, weighted routes, match conditions, retries, timeouts, fault injection, and load-balancing policy.

Core rules

• A Gateway configures ingress ports and selects gateway pods by label. A VirtualService binds to a host and defines ordered match and route rules.
• A DestinationRule defines subsets using pod labels and sets trafficPolicy: load balancer, connection pool, outlier detection, and TLS mode.
• Route weights across destinations should total 100. The first matching route wins, so specific matches must come before catch-all routes.
• Use gateway mesh for sidecar-to-sidecar traffic; use the ingress gateway name for north-south traffic. The VirtualService host must resolve to a Kubernetes Service, ServiceEntry, or the gateway host.

Worked example

Service reviews has pods labeled version=v1 and version=v2. A DestinationRule declares subsets v1 and v2 with those labels. A VirtualService for host reviews routes to subset v1 with weight 90 and subset v2 with weight 10. Reasoning: the DestinationRule supplies the subset definitions; the VirtualService supplies the split. If the subset label is wrong or the weights do not sum to 100, Envoy rejects or misroutes the configuration.

Traps

• Referencing a subset that the DestinationRule does not define produces a route with no healthy destination.
• A VirtualService in the wrong namespace, or with a host that does not match the Service, is ignored for that workload.
• Gateway selector labels must match the ingress gateway pods; a mismatch yields no listeners.
• Retries can multiply load and mask failures; a short timeout plus retries can cause unexpected 504s.
• Fault injection is a route-level action; applying it to the wrong match affects all traffic.