I85PREP
⌘ K
ICA study materials
ICA study resources

ICA: Traffic Management

ICA · Work through your exam, one topic at a time.

All guide sections

Traffic Management

What this domain tests

Traffic Management tests the request path from a gateway to a workload: how Gateways expose ports, VirtualServices match and split requests, and DestinationRules define subsets and resilience. Questions often ask why a route is ignored or why weights do not reach the intended pods.

Core rules

  • The edge path is client -> Gateway -> VirtualService -> DestinationRule -> subset endpoints. A Gateway selects gateway pods by selector labels; a VirtualService binds to it with gateways and matches on hosts.
  • HTTP routes can match URI exact, prefix, or regex plus headers. Order routes from most specific to least; destination weights split traffic.
  • A DestinationRule declares subsets from pod labels and sets load balancing, connection pool, outlier detection, and TLS.
  • Resilience uses timeout; retries with attempts, perTryTimeout, and retryOn; and fault injection with delay or abort and a percentage.
  • Service port names must carry the protocol (http, http2, grpc) or L7 routing is not applied.

Worked example

You want 90/10 canary traffic to reviews. A DestinationRule defines subsets v1 (version: v1) and v2 (version: v2). The VirtualService host is reviews.prod.svc.cluster.local and its route has weights 90 and 10. Reasoning: the VirtualService host must resolve to the service, both subsets must match real pod labels, and weights should total 100. A missing subset leaves Envoy without a cluster and produces 503s.

Traps

Gateway selector not matching the ingress deployment; VirtualService host or gateway binding wrong; forgetting the DestinationRule before using subsets; using the mesh gateway for external traffic; and naming a port tcp, which disables HTTP matching.