Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Which need is best solved by a service mesh rather than NetworkPolicy alone?

   1. ABlocking all traffic to a namespace
   2. BEncrypting service-to-service traffic and authorising calls by workload identity (not IP), with uniform per-request metrics
   3. CAssigning pod IPs
   4. DScheduling pods
   Show answer

   B. NetworkPolicy works on IPs/ports (L3/L4). A mesh adds cryptographic identity, L7 policy and telemetry.

   From lesson 01 · Why (and why not) a mesh

2. Q2. What's a real cost of adopting a mesh?

   1. ANone
   2. BExtra resource use and latency per hop, plus a new, critical layer to upgrade, secure and debug; misconfiguration can break all traffic
   3. CIt removes Kubernetes Services
   4. DIt disables autoscaling
   Show answer

   B. The mesh sits in every request path; its reliability becomes the platform's reliability.

   From lesson 01 · Why (and why not) a mesh

3. Q3. A platform only needs encrypted pod-to-pod traffic for compliance. What might be simpler than a full mesh?

   1. ANothing
   2. BCNI-level transparent encryption (e.g. WireGuard or IPsec in Cilium or Calico), if identity-based L7 authorisation isn't required
   3. CDisabling TLS
   4. DMore replicas
   Show answer

   B. Encryption alone doesn't need a mesh. Choose the smallest tool that meets the requirement.

   From lesson 01 · Why (and why not) a mesh

4. Q4. What does istiod do?

   1. AProxies all traffic itself
   2. BIt's the control plane: watches Kubernetes and Istio config, converts it to Envoy configuration pushed to proxies (xDS), and issues workload certificates
   3. CIt's a CNI plugin
   4. DIt stores metrics
   Show answer

   B. Traffic never flows through istiod; it configures the proxies that carry traffic.

   From lesson 02 · Istio architecture

5. Q5. In ambient mode, what does ztunnel handle?

   1. AL7 routing and retries
   2. BPer-node L4 functions: mTLS (HBONE tunnels), identity, L4 authorization and telemetry for pods on that node, without sidecars
   3. CDNS only
   4. DIngress certificates
   Show answer

   B. L7 features (HTTP routing, retries, L7 policy) need a waypoint proxy in ambient mode.

   From lesson 02 · Istio architecture

6. Q6. You labelled a namespace for sidecar injection, but existing pods have no sidecar. Why?

   1. AIstio is broken
   2. BInjection happens at pod creation via a mutating webhook; existing pods must be restarted (e.g. kubectl rollout restart)
   3. CLabels don't work
   4. DSidecars are optional per container
   Show answer

   B. Restart workloads after enabling injection or upgrading the sidecar version.

   From lesson 02 · Istio architecture

7. Q7. What's distinctive about Linkerd's data plane?

   1. AIt uses Envoy
   2. BIt uses linkerd2-proxy, a small purpose-built proxy written in Rust, designed for low resource use and security rather than general-purpose features
   3. CIt has no proxy
   4. DIt runs in the kernel
   Show answer

   B. A narrower feature set in exchange for simplicity and efficiency is Linkerd's core design choice.

   From lesson 03 · Linkerd architecture

8. Q8. What must operators manage manually in a Linkerd installation?

   1. ANothing
   2. BThe trust anchor (root) certificate's lifecycle, and the issuer certificate unless automated (e.g. with cert-manager); expired certificates break mTLS
   3. CPod IPs
   4. Detcd
   Show answer

   B. Workload certificates rotate automatically, but the root and issuer have their own expiry dates that need a plan.

   From lesson 03 · Linkerd architecture

9. Q9. Is mTLS in Linkerd opt-in per service?

   1. AYes, always
   2. BNo: traffic between meshed pods is mTLS'd automatically by default
   3. COnly for HTTP/2
   4. DOnly with a license
   Show answer

   B. Meshing a workload is enough to get mTLS between meshed peers.

   From lesson 03 · Linkerd architecture

10. Q10. Where does a workload's mesh identity come from?

    1. AIts IP address
    2. BIts Kubernetes service account (and namespace), encoded as a SPIFFE ID in a short-lived certificate issued by the mesh CA
    3. CThe node name
    4. DThe container image
    Show answer

    B. That's why each workload should have its own service account: shared accounts mean shared identities.

    From lesson 04 · mTLS & identity

11. Q11. Why roll out mTLS in PERMISSIVE mode first?

    1. AIt's more secure
    2. BPERMISSIVE accepts both plaintext and mTLS, so un-meshed callers keep working while you mesh everything; then switch to STRICT once all callers use mTLS
    3. CSTRICT doesn't exist
    4. DFor performance
    Show answer

    B. Switching straight to STRICT breaks any caller without a proxy (jobs, other namespaces, external clients).

    From lesson 04 · mTLS & identity

12. Q12. What does an identity-based AuthorizationPolicy give over a NetworkPolicy?

    1. ANothing
    2. BRules based on cryptographically verified caller identity (and L7 attributes like method/path), independent of IPs that change with every pod restart
    3. CFaster routing
    4. DIP allocation
    Show answer

    B. IPs are ephemeral; identities are stable and verified via mTLS.

    From lesson 04 · mTLS & identity

13. Q13. Why can retries turn a small blip into an outage?

    1. AThey can't
    2. BWhen a service is slow or failing, every caller retrying multiplies load (and each layer retrying multiplies again), overwhelming the struggling service; this is a retry storm
    3. CRetries use more disk
    4. DThey disable mTLS
    Show answer

    B. Three layers each retrying 3 times can turn 1 request into 27+. Budgets, backoff and retrying at one layer only prevent this.

    From lesson 05 · Traffic management

14. Q14. What does outlier detection do?

    1. ADetects slow users
    2. BTemporarily ejects endpoints (pods) that return consecutive errors from the load-balancing pool, so traffic goes to healthy ones
    3. CScales pods
    4. DBlocks attackers
    Show answer

    B. It's the mesh's circuit breaker at the endpoint level.

    From lesson 05 · Traffic management

15. Q15. Which requests are generally safe to retry automatically?

    1. AAll of them
    2. BIdempotent requests (GET, and operations designed to be repeatable) on connection-level or clearly transient failures
    3. COnly POST
    4. DOnly requests that timed out after 30 s
    Show answer

    B. Retrying a non-idempotent POST can create duplicate orders.

    From lesson 05 · Traffic management

16. Q16. Why filter Istio metrics by `reporter`?

    1. AFor colour
    2. BBoth the client-side and server-side proxies report the same request; without choosing one reporter, you count requests twice
    3. CIt's required syntax
    4. DTo hide errors
    Show answer

    B. Use reporter="destination" for a service's own view; reporter="source" to see what callers experience (including network failures).

    From lesson 06 · Mesh observability

17. Q17. Does a service mesh give you complete distributed traces automatically?

    1. AYes, always
    2. BNo: proxies can emit spans, but applications must propagate trace headers from incoming to outgoing requests, or each hop appears as a separate trace
    3. COnly with Linkerd
    4. DOnly for gRPC
    Show answer

    B. The proxy can't know which outgoing call belongs to which incoming request inside your process.

    From lesson 06 · Mesh observability

18. Q18. Where are mesh metrics most useful compared with app metrics?

    1. ANowhere
    2. BUniform success rate, RPS and latency for every service and every caller→callee pair, including services that aren't instrumented
    3. CBusiness KPIs
    4. DDatabase internals
    Show answer

    B. Consistency across all services is the key value. Business and internal metrics still come from apps.

    From lesson 06 · Mesh observability

19. Q19. What's the advantage of Istio's revision-based (canary) upgrades?

    1. AThey're faster
    2. BThe new control plane runs alongside the old; you move namespaces to it gradually and can move them back, instead of upgrading everything at once
    3. CThey need no restarts
    4. DThey skip testing
    Show answer

    B. Blast radius is limited to the namespaces you've moved, and rollback is a relabel + restart.

    From lesson 07 · Upgrades & production patterns

20. Q20. Why do meshed workloads need restarts after a control-plane upgrade?

    1. AThey don't
    2. BSidecar proxies are injected at pod creation; existing pods keep the old proxy version until they're recreated
    3. CTo clear caches
    4. DFor licence checks
    Show answer

    B. Plan rolling restarts per namespace, respecting PDBs, and verify proxy versions afterwards.

    From lesson 07 · Upgrades & production patterns

21. Q21. What's a sensible 'escape hatch' for a mesh incident?

    1. ADelete the cluster
    2. BA tested, documented way to take a namespace or workload out of the mesh (or relax STRICT mTLS/policies) quickly, with approval rules, so a mesh problem doesn't prolong an outage
    3. CDisable monitoring
    4. DRestart etcd
    Show answer

    B. Know how to bypass the mesh safely before you need to, and practise it.

    From lesson 07 · Upgrades & production patterns