SRE Service Mesh and Microservices Reliability

Question 1

What is the primary difference between a service mesh and traditional client-side load balancing?

Accepted Answer

A service mesh uses sidecar proxies to handle load balancing, retries, and circuit breaking transparently at the infrastructure layer, while client-side libraries require each application to implement these behaviors in its own code

Answer

A service mesh only works with containerized applications; client-side load balancing works with any application type

Answer

A service mesh operates at Layer 4 (TCP); client-side load balancing operates at Layer 7 (HTTP)

Answer

A service mesh requires every service to use the same programming language to share the load balancing library

Question 2

In a service mesh, what is 'traffic mirroring' (shadow traffic), and how is it used to improve reliability?

Accepted Answer

Traffic mirroring sends a copy of live production requests to a shadow service version, allowing testing of new versions with real traffic patterns without affecting production users

Answer

Traffic mirroring creates redundant copies of all service-to-service calls to ensure delivery if the primary path fails

Answer

Traffic mirroring records all service interactions for compliance auditing without impacting service performance

Answer

Traffic mirroring distributes identical requests to multiple services to compare response times and select the fastest

Question 3

What is 'mutual TLS' (mTLS) in a service mesh, and why is it important for microservices security?

Accepted Answer

mTLS requires both the client and server to present certificates, ensuring that only authenticated services can communicate — preventing impersonation attacks within the cluster

Answer

mTLS is TLS with dual encryption passes to provide stronger cipher strength than standard TLS

Answer

mTLS enables services to bypass certificate validation when communicating within a trusted internal network

Answer

mTLS is a protocol for load balancers to authenticate to backend services using shared secrets

Question 4

What is the 'bulkhead pattern' in microservices architecture, and how does it improve reliability?

Accepted Answer

The bulkhead pattern isolates resources (thread pools, connection pools) per downstream dependency so that a slow or failing dependency only exhausts its own resource pool, not shared resources that would affect all services

Answer

The bulkhead pattern replicates every microservice to multiple availability zones to prevent regional failures

Answer

The bulkhead pattern uses rate limiting at the API gateway to prevent any single client from overloading the service

Answer

The bulkhead pattern requires all microservices to share a single connection pool to simplify resource management

Question 5

What is the difference between 'retry-on-error' and 'retry-on-timeout' strategies, and which is SAFER in a microservices environment?

Accepted Answer

Retry-on-5xx is generally safer than retry-on-timeout because a 5xx response confirms the request was received and failed; a timeout leaves uncertainty about whether the request was processed

Answer

Retry-on-timeout is always safer because it only retries requests that definitively did not reach the server

Answer

Both strategies are equally safe when the downstream service is idempotent

Answer

Neither strategy is safe without first checking if the retry would violate the retry budget

Question 6

What is 'service discovery' in a microservices architecture, and what are the two main patterns for implementing it?

Accepted Answer

Service discovery allows services to find each other's network locations dynamically; the two main patterns are client-side discovery (client queries a registry and selects an instance) and server-side discovery (client routes through a load balancer that queries the registry)

Answer

Service discovery is the process of automatically provisioning new service instances; the two patterns are pull-based (services request capacity) and push-based (orchestrator assigns capacity)

Answer

Service discovery is DNS-based name resolution; the two patterns are static DNS records and dynamic DNS with TTL-based refresh

Answer

Service discovery is monitoring that detects when new services are deployed; the two patterns are agent-based and agentless collection