Service Mesh (Istio, Linkerd) Questions and Answers for Viva

Answer-1: A service mesh is a dedicated infrastructure layer for handling service-to-service communication in a microservices architecture.

Answer-2: It provides observability, traffic control, security, and reliability for microservices without changing application code.

Answer-3: The key components are data plane (sidecar proxies) and control plane (manages configuration and policies).

Answer-4: Istio is a popular open-source service mesh that provides advanced traffic management, security, and observability for microservices.

Answer-5: Linkerd is a lightweight, open-source service mesh designed for simplicity, performance, and security.

Answer-6: A sidecar proxy is a separate container or process deployed alongside each service instance to intercept and manage network traffic.

Answer-7: Istio uses Envoy as its sidecar proxy.

Answer-8: Linkerd uses its own lightweight Rust-based proxy called `linkerd2-proxy`.

Answer-9: It collects telemetry data like metrics, logs, and traces from the sidecar proxies.

Answer-10: mTLS is a security feature where both client and server authenticate each other to establish trust and encrypt communication.

Answer-11: Yes, Istio supports automatic mutual TLS between services.

Answer-12: Linkerd enables mTLS by default with minimal configuration, making security easy to adopt.

Answer-13: Traffic shifting allows gradual rollout of new versions by sending a percentage of traffic to different service versions.

Answer-14: Yes, Linkerd supports traffic splitting for canary deployments and A/B testing.

Answer-15: The control plane manages the configuration and policy rules for the data plane.

Answer-16: The data plane handles the actual network traffic between services using sidecar proxies.

Answer-17: Istiod is Istio?s control plane component that manages configuration, certificates, and policy enforcement.

Answer-18: Linkerd is simpler and lighter, with easier setup and fewer dependencies, while Istio offers more advanced features.

Answer-19: Envoy is a high-performance proxy developed by Lyft and used by Istio as its sidecar.

Answer-20: Linkerd's proxy is written in Rust for performance and safety.

Answer-21: Telemetry includes collecting metrics, logs, and traces to monitor and troubleshoot service communication.

Answer-22: Yes, Istio integrates natively with Prometheus for metrics collection.

Answer-23: Yes, Linkerd works well with Grafana for visualizing metrics and service performance.

Answer-24: A virtual service defines how requests are routed to a service in Istio.

Answer-25: A destination rule defines policies for traffic to a service, such as load balancing and TLS settings.

Answer-26: Linkerd provides built-in dashboards, metrics, and tap features for live traffic inspection.

Answer-27: Automatic sidecar injection automatically adds the sidecar proxy to pods in specified namespaces.

Answer-28: Circuit breaking prevents cascading failures by stopping requests to services that are failing or overloaded.

Answer-29: Yes, Istio supports circuit breaking through destination rules.

Answer-30: Retries can be configured in the virtual service with retry count and timeout settings.

Answer-31: Rate limiting controls the number of requests a service can receive in a given time frame.

Answer-32: Istio supports rate limiting using Envoy filters or external policy systems like Redis.

Answer-33: An ingress gateway manages external traffic entering the mesh.

Answer-34: An egress gateway controls external traffic leaving the mesh to ensure security and visibility.

Answer-35: Namespaces group services and allow applying policies and configurations to specific environments.

Answer-36: Linkerd can be installed using the Linkerd CLI and requires minimal configuration.

Answer-37: Istio requires Kubernetes and tools like `istioctl` or Helm for installation.

Answer-38: Service discovery enables automatic detection of services and routing between them.

Answer-39: Istio uses Kubernetes DNS and service registry to discover services.

Answer-40: `linkerd tap` is a CLI command to observe real-time request and response data for a service.

Answer-41: Istio is primarily designed for Kubernetes but can be extended to VMs with additional setup.

Answer-42: SMI is a standard interface specification to provide a common way for service meshes to expose capabilities.

Answer-43: Yes, Linkerd supports SMI for compatibility with tools and environments.

Answer-44: Mesh expansion is the process of adding non-Kubernetes workloads or VMs to the service mesh.

Answer-45: Using the Linkerd dashboard, Prometheus, and Grafana.

Answer-46: Istio supports integration with Fluentd, Elasticsearch, and Kibana for centralized logging.

Answer-47: Zero-trust means enforcing authentication, authorization, and encryption for every communication.

Answer-48: Istio uses authorization policies based on roles and attributes to allow or deny requests.

Answer-49: Use cases include observability, secure service communication, traffic control, and resilience in microservices.

Answer-50: Service mesh is evolving toward greater simplicity, interoperability, and deeper integration with DevOps and CI/CD pipelines.