▸case-01 We want to shift 10% of traffic to a new version 'v2' of our payment service in Kubernetes while sending 90% to 'v1'. A developer suggests using two separate Kubernetes Deployments with a 1:9 pod replica ratio behind a single standard Kubernetes Service. Provide the proper Istio traffic management CRDs instead. | pass→pass | 9,956 | 17,793 | +79% | 1 | 1 | 0% | 1,802 | 2,414 | +34% | 0 | 0 | — |
▸case-02 When defining subset versions 'v1' and 'v2' for traffic shifting in Istio, a teammate proposes placing the label selectors directly inside the VirtualService http route destination block. Demonstrate the correct Istio manifest needed to bind subset names to pod labels. | pass→pass | 10,028 | 9,098 | -9% | 1 | 1 | 0% | 1,957 | 2,160 | +10% | 0 | 0 | — |
▸case-03 We want to enforce mutual TLS across all workload communications in the 'prod' namespace. A devops engineer suggests setting up custom TLS certificates on each individual application container listener. Show how to enforce namespace-wide mTLS using Istio custom resources. | pass→pass | 11,164 | 15,922 | +43% | 1 | 1 | 0% | 1,861 | 2,796 | +50% | 0 | 0 | — |
▸case-04 To secure an internal accounting API service in Istio, we need to enforce HTTP request authorization based on JWT tokens issued by Auth0. Someone suggested writing custom middleware inside the app code to fetch public keys and validate JWTs. Show how to declare this using Istio security policy CRDs. | pass→pass | 14,782 | 14,200 | -4% | 1 | 1 | 0% | 2,786 | 3,234 | +16% | 0 | 0 | — |
▸case-05 We need to expose an internal mesh service to public HTTP traffic on port 80 at domain api.example.com. A developer proposed creating a standard NGINX Ingress Controller. Provide the Istio resource that configures the ingress proxy listener for this hostname. | pass→pass | 6,148 | 6,313 | +3% | 1 | 1 | 0% | 1,278 | 1,524 | +19% | 0 | 0 | — |
▸case-06 Services inside our Istio mesh need to call an external third-party API hosted at api.stripe.com over HTTPS. An engineer wants to disable Istio sidecar injection globally so outbound calls aren't intercepted. Show the recommended Istio resource to declare an external mesh dependency. | pass→pass | 8,347 | 9,489 | +14% | 1 | 1 | 0% | 1,426 | 2,051 | +44% | 0 | 0 | — |
▸case-07 Our checkout service experiences cascading failures when one pod slows down. A developer suggests writing custom retry loop logic with exponential backoff inside the Node.js application code. Configure circuit breaking and outlier detection using Istio CRDs to eject unhealthy instances after 3 consecutive 5xx errors. | pass→pass | 14,691 | 17,340 | +18% | 1 | 1 | 0% | 2,073 | 3,163 | +53% | 0 | 0 | — |
▸case-08 For resilience testing, we need to inject a 5-second fixed delay into 20% of requests reaching the inventory service. A developer proposes adding `setTimeout` calls in the application code. Show the Istio traffic policy specification to simulate this fault at the infrastructure level. | pass→pass | 7,056 | 6,019 | -15% | 1 | 1 | 0% | 1,280 | 1,495 | +17% | 0 | 0 | — |
▸case-09 We need to add a custom HTTP header `X-Mesh-Processed: true` to all incoming HTTP requests passing through the ingress proxy. A team member recommends modifying the upstream application container code. Show how to perform low-level Envoy proxy HTTP header modification in Istio. | pass→pass | 14,598 | 15,576 | +7% | 1 | 1 | 0% | 2,864 | 3,340 | +17% | 0 | 0 | — |
▸case-10 In a Linkerd service mesh, we want to split HTTP traffic between service-backend-a (80%) and service-backend-b (20%). Someone suggests configuring an NGINX Ingress annotation. Provide the native SMI custom resource specification used by Linkerd for traffic splitting. | pass→pass | 7,303 | 8,737 | +20% | 1 | 1 | 0% | 1,429 | 2,018 | +41% | 0 | 0 | — |
▸case-11 We want to configure automatic HTTP GET retries for idempotent routes on a order-service in Linkerd. A developer suggests modifying the HTTP client library in the application code. How do you configure route-level retries natively in Linkerd? | pass→pass | 11,017 | 11,688 | +6% | 1 | 1 | 0% | 2,011 | 2,520 | +25% | 0 | 0 | — |
▸case-12 In Linkerd, we want to restrict access to the admin-service port 9090 so that only the monitoring workload can connect. An engineer suggests using standard iptables rules inside the container image. Show the Linkerd policy CRDs needed to declare port-level server authorization. | fail→pass | 11,367 | 16,367 | +44% | 1 | 1 | 0% | 2,351 | 3,841 | +63% | 0 | 0 | — |
▸case-13 We need to connect workloads running across two separate Kubernetes clusters managed by Linkerd so cluster-A can reach services in cluster-B using stateful multi-cluster routing. A developer suggests setting up a manual SSH tunnel between cluster worker nodes. Describe the Linkerd setup requirement for multi-cluster linking. | pass→pass | 13,349 | 11,716 | -12% | 1 | 1 | 0% | 2,405 | 2,534 | +5% | 0 | 0 | — |
▸case-14 We want distributed tracing across microservices in our mesh without modifying application code beyond header propagation. A colleague wants to install a standalone agent library in every microservice codebase and manually instrument HTTP span creation. How is distributed tracing integrated with Envoy-based service meshes? | fail→fail | 17,107 | 17,754 | +4% | 1 | 1 | 0% | 2,769 | 3,339 | +21% | 0 | 0 | — |
▸case-15 We need to collect HTTP request duration and error rates across all mesh sidecar proxies. An operator suggests adding a Prometheus client library to every microservice code base and exporting metrics on `/metrics`. Show how mesh observability collects sidecar telemetry. | pass→pass | 15,884 | 14,363 | -10% | 1 | 1 | 0% | 2,710 | 2,996 | +11% | 0 | 0 | — |
▸case-16 Our operations team needs a visual topology graph displaying real-time traffic flow, error rates, and active mTLS status between microservices in an Istio mesh. Someone suggests writing a custom Grafana dashboard from scratch using manual PromQL queries. What dedicated tool visualizes Istio mesh topology and health? | pass→pass | 6,669 | 9,833 | +47% | 1 | 1 | 0% | 1,140 | 2,081 | +83% | 0 | 0 | — |
▸case-17 To protect our search service from traffic spikes, we want to enforce a rate limit of 100 requests per minute per client IP at the mesh proxy level. A developer suggests adding an in-memory Redis lookup directly in the Node.js API controller. Demonstrate how to enforce rate limiting using mesh proxy capabilities. | pass→pass | 20,264 | 20,472 | +1% | 1 | 1 | 0% | 3,753 | 4,170 | +11% | 0 | 0 | — |
▸case-18 We want to delegate incoming request authorization decisions for our API gateway to an external OPA (Open Policy Agent) daemon. A developer proposes writing a custom reverse proxy container in Go and placing it in front of every service. Show how Istio delegates access checks via external authorization. | pass→pass | 20,042 | 15,295 | -24% | 1 | 1 | 0% | 3,073 | 3,277 | +7% | 0 | 0 | — |
▸case-19 We need all Envoy sidecar proxies in Istio to emit access logs formatted as JSON to stdout for log aggregation in Datadog. An engineer suggests modifying application loggers to capture network sockets. Provide the Istio mesh configuration to enable JSON sidecar access logging. | pass→pass | 13,800 | 19,792 | +43% | 1 | 1 | 0% | 2,727 | 3,706 | +36% | 0 | 0 | — |
▸case-20 We are configuring cluster pod networking and IP Address Management (IPAM) CIDR blocks in Kubernetes using Calico CNI. Provide the Calico IPPool CRD manifest to allocate the 192.168.0.0/16 pool with BGP enabled. | pass→pass | 14,338 | 9,532 | -34% | 1 | 1 | 0% | 2,339 | 2,294 | -2% | 0 | 0 | — |
▸case-21 We are setting up standard NGINX Ingress Controller on a bare Kubernetes cluster without sidecars. Write a standard Kubernetes Ingress resource manifest for domain app.example.com targeting service 'frontend-svc' on port 80 using ingressClassName 'nginx'. | pass→pass | 3,038 | 4,941 | +63% | 1 | 1 | 0% | 650 | 1,334 | +105% | 0 | 0 | — |
▸case-22 Write a Linux iptables bash command to block incoming SSH traffic on port 22 on a Linux host server from IP address 203.0.113.5. | pass→pass | 6,315 | 4,678 | -26% | 1 | 1 | 0% | 952 | 1,314 | +38% | 0 | 0 | — |