Istio
Hard
Architecture
In Istio ambient mode, which component handles mTLS and L4 policy for the pods on each node?
Select your answer:
Show answer and explanation
Answer: ztunnel, a per-node proxy
Explanation
Ambient mode removes sidecars. ztunnel runs as a DaemonSet, carries pod traffic in mTLS over HBONE tunnels and enforces L4 authorization. L7 features need a waypoint proxy, which you deploy only where you need it.
More hard Istio questions
- A namespace runs in Istio ambient mode. You need HTTP header-based routing and L7 authorization for one of its services. What do you add?
- A workload has AuthorizationPolicies with CUSTOM, DENY, and ALLOW actions. In what order does Istio check them?
- The mesh-wide PeerAuthentication in istio-system sets STRICT. The namespace has one that sets PERMISSIVE. A workload-specific policy sets portLevelMtls to DISABLE for port 8080. Which mode applies to port 8080 of that workload?
- An application in an Istio sidecar pod fails at startup because its first outbound calls happen before the Envoy sidecar is ready. Which setting fixes this?
- What is the purpose of Istio's WorkloadEntry resource?
- What is the purpose of Istio's WorkloadGroup resource?