ICA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Istio upgrade path

Must upgrade one minor version at a time; skipping minor versions is not supported. Each minor is supported for six months after release.

istioctl install profiles

Profiles: minimal (istiod only), default (istiod and ingress gateway), demo (all components with lower resources), empty (no components). Choose based on environment needs.

Revision-based upgrade

Install new control plane with a revision name, then label namespaces with istio.io/rev to migrate workloads gradually. Old revision remains until uninstalled.

Sidecar injection label

Namespace label istio-injection=enabled enables injection. For revision-based, use istio.io/rev=<revision>. Pod annotation sidecar.istio.io/inject=false disables injection for that pod.

IstioOperator custom configuration

Use istioctl install -f custom.yaml to merge with default profile. Fields include components, meshConfig, values. istioctl profile dump shows effective configuration.

istioctl x precheck

Validates cluster compatibility before installation, checking Kubernetes version and CRD conflicts. Run before install or upgrade to avoid failures.

Uninstall with purge

istioctl uninstall --purge removes all Istio resources including CRDs. Without --purge, CRDs and custom resources remain, allowing reinstall or revision cleanup.

VirtualService routing

Defines HTTP/TCP/TLS routes with match conditions (URI, headers, method, source labels) and destinations with weights. Binds to gateways for ingress traffic.

DestinationRule subsets

Defines subsets of a service using labels, and traffic policies like load balancing, connection pool, outlier detection, and TLS settings for each subset.

Traffic splitting weights

In VirtualService HTTP route, specify multiple destinations with weight values summing to 100. Used for canary releases; weights are relative proportions.

Fault injection

VirtualService HTTP fault field injects delay (fixedDelay, percentage) or abort (httpStatus, percentage) before routing. Used for chaos testing and resilience validation.

ServiceEntry external services

Adds external services to mesh registry with hosts, addresses, ports, location (MESH_EXTERNAL), and resolution (DNS, STATIC, NONE). Required for external access when outboundTrafficPolicy is REGISTRY_ONLY.

Sidecar resource scope

Limits the scope of configuration for proxies by specifying egress hosts and ingress listeners. Reduces memory and config size; applied per namespace or workload selector.

Traffic mirroring

VirtualService HTTP mirror field sends a copy of traffic to another destination. mirrorPercentage controls fraction. Original response is returned to client.

Gateway TLS modes

Gateway server TLS modes: SIMPLE (server certificate), MUTUAL (client certificate verification), PASSTHROUGH (no termination). credentialName references a Kubernetes secret.

PeerAuthentication mTLS mode

Sets mTLS mode: STRICT (reject plaintext), PERMISSIVE (accept both), DISABLE. Applied mesh-wide (root namespace), namespace-wide, or workload-specific.

AuthorizationPolicy actions

Actions: ALLOW, DENY, AUDIT, CUSTOM. Rules match source (principals, namespaces, IP blocks), operation (methods, paths, ports), and conditions. Default deny if any policy applied.

RequestAuthentication JWT validation

Validates JWT tokens with issuer, jwksUri, and audiences. Applied to workloads. Invalid tokens rejected, but requests without tokens allowed unless AuthorizationPolicy requires authentication.

JWT claim-based authorization

AuthorizationPolicy with when conditions on request.auth.claims enables fine-grained access control based on JWT claims. Requires RequestAuthentication.

SPIFFE identity format

Istio issues SPIFFE certificates with URI SAN spiffe://<trust-domain>/ns/<namespace>/sa/<serviceaccount>. Encodes workload identity for mTLS.

AuthorizationPolicy evaluation order

Deny policies evaluated first, then allow. If no allow policies, default allow; if allow policies exist, default deny. Audit policies log but do not enforce.

Egress TLS origination

DestinationRule trafficPolicy tls mode SIMPLE or ISTIO_MUTUAL originates TLS for external services. Use with ServiceEntry to enable secure egress.

Ingress TLS with Gateway

Gateway with TLS mode SIMPLE or MUTUAL terminates TLS using certificate from Kubernetes secret referenced by credentialName in istio-system namespace.

istioctl analyze

Detects configuration issues like conflicting VirtualServices, missing gateways, deprecated fields. Use --all-namespaces and --suppress to filter.

istioctl proxy-status

Shows sync status of Envoy proxies with Istiod: SYNCED, NOT SENT, STALE. Indicates configuration push issues.

istioctl proxy-config

Inspects Envoy configuration: cluster, listener, route, endpoint for a pod. Use -o json for detailed view. Helps diagnose routing and load balancing.

503 no healthy upstream

Common causes: no endpoints, mTLS mismatch (PeerAuthentication), missing ServiceEntry for external hosts. Use istioctl proxy-config endpoint to verify.

Envoy access logs

Enable via meshConfig.accessLogFile=/dev/stdout. Logs show response code, flags, upstream host. Useful for diagnosing routing and failures.

istioctl x describe pod

Summarizes configuration applied to a pod: services, virtualservices, destinationrules, and potential issues. Helps troubleshoot misconfigurations.

Control plane debug logs

Istiod logs at debug level with --log_level=debug. Check for push errors, certificate issues, webhook failures. Use kubectl logs -n istio-system deploy/istiod.

Sidecar injection failure

Check namespace label, pod annotation, and istio-init container logs. Injection webhook may be down or misconfigured. Verify with istioctl analyze.

istioctl dashboard

Opens Grafana, Jaeger, Kiali, or Prometheus dashboards. Requires addons installed. Port-forward to access.