Istio
Hard
Architecture
A namespace runs in Istio ambient mode. You need HTTP header-based routing and L7 authorization for one of its services. What do you add?
Select your answer:
Show answer and explanation
Answer: A waypoint proxy, with the namespace or service labeled to use it
Explanation
ztunnel only works at L4. For HTTP routing, retries, fault injection or L7 AuthorizationPolicy, you deploy a waypoint, an Envoy-based proxy you can create with 'istioctl waypoint apply'. Then you label the namespace or service with istio.io/use-waypoint so its traffic goes through it.
More hard Istio questions
- A workload has AuthorizationPolicies with CUSTOM, DENY, and ALLOW actions. In what order does Istio check them?
- The mesh-wide PeerAuthentication in istio-system sets STRICT. The namespace has one that sets PERMISSIVE. A workload-specific policy sets portLevelMtls to DISABLE for port 8080. Which mode applies to port 8080 of that workload?
- An application in an Istio sidecar pod fails at startup because its first outbound calls happen before the Envoy sidecar is ready. Which setting fixes this?
- What is the purpose of Istio's WorkloadEntry resource?
- What is the purpose of Istio's WorkloadGroup resource?
- What is the purpose of Istio's 'consistentHash' load balancing in DestinationRule?