Service Mesh Flashcards

What is mutual TLS (mTLS) in the context of a service mesh?

Answer: Both client and server authenticate each other using certificates

Mutual TLS requires both the client and server to present certificates, ensuring bidirectional identity verification.

Which Istio control plane component was historically responsible for certificate issuance and rotation?

Answer: Citadel

Citadel was the Istio component that managed service identity and certificate lifecycle, though its functions are now merged into istiod.

What does 'PERMISSIVE' mode mean for Istio's peer authentication policy?

Answer: Both plaintext and mTLS traffic are accepted

PERMISSIVE mode allows a service to accept both mTLS-encrypted and plaintext connections, useful during migration to strict mTLS.

Which open-source service mesh uses a per-node proxy model instead of per-pod sidecars?

Answer: Cilium Service Mesh

Cilium Service Mesh uses eBPF-based per-node proxying rather than injecting a sidecar container into every pod.

In Linkerd, what is the control plane component called that provides the CLI and dashboard?

Answer: linkerd-viz

Linkerd-viz is the extension that provides the web dashboard, metrics, and Tap features for observing traffic.

What Kubernetes annotation is typically used to enable automatic sidecar injection in Istio?

Answer: sidecar.istio.io/inject: 'true'

The annotation 'sidecar.istio.io/inject: true' on a pod or namespace enables automatic Envoy sidecar injection.

Which metric type in a service mesh represents the number of requests per second passing through the mesh?

Answer: Throughput (RPS)

Throughput measured in requests per second (RPS) indicates how much traffic the mesh is processing.