Service Mesh: Istio & Linkerd
The platform layer for service-to-service traffic. Learn sidecars and ambient mode, traffic management, mTLS and zero trust, resilience patterns, mesh observability and the istioctl diagnostics you reach for when a route misbehaves — and remember it with spaced repetition.
- flashcards
- 118
- flashcards
- per day
- ~10 min
- per day
- level
- Intermediate → Advanced
- level
- modules
- 7
- modules
What is a service mesh?
A service mesh is a dedicated infrastructure layer that handles service-to-service communication — routing, security and telemetry — outside your application code. Proxies (Envoy sidecars in Istio, micro-proxies in Linkerd, or ambient/sidecarless modes) sit on the request path, so every call gets mTLS, retries and metrics without touching the app.
The mental model that makes everything click is the split between the data plane (the proxies moving your traffic) and the control plane (the brain configuring them). From there the features follow: traffic splitting for canary releases, retry budgets that prevent retry storms, authorization policies for zero-trust networking, and RED metrics for every service — for free.
This track is the advanced tier of the Kubernetes family: it assumes you know Pods, Services and Deployments, and leads with concepts, naming Istio and Linkerd where the implementations genuinely differ. Two modules go deliberately Istio-specific — installation, revisions and ambient mode, plus the istioctl diagnostics for a mesh that is misbehaving — because that is where operating a mesh actually happens. If you are studying for the exam, the Istio Certified Associate guide maps this track onto the four ICA domains and says which module is off-blueprint.
7 modules, seed to bloom
Each module is a set of flashcards — 118 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
Mesh Concepts & Architecture
What a mesh is, data vs control plane, sidecars, ambient mode, and when to use one
16 cardsIstio Install, Upgrade & Ambient
Helm charts and profiles, sidecar injection, revisions and canary upgrades, ambient mode
16 cardsTraffic Management
L7 routing, canary releases, retries and timeouts, mirroring, and load balancing
19 cardsSecurity & mTLS
Mutual TLS, workload identity, authorization policies, and zero-trust networking
19 cardsResilience Patterns
Circuit breaking, outlier detection, fault injection, rate limiting, and failover
16 cardsMesh Observability
Golden signals from the proxies, RED metrics, tracing propagation, and access logs
16 cardsTroubleshooting the Mesh
istioctl diagnostics, config propagation, Envoy response flags, and the classic mesh failures
16 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
What is a service mesh?
- AAn infrastructure layer managing service-to-service traffic — apps offload routing, security and telemetry
- BA message broker between services — requests are queued and delivered asynchronously by the platform
- CA Kubernetes network plugin — it assigns Pod IPs and wires the cluster's low-level connectivity
- DAn API gateway for internal APIs — a central proxy terminates and forwards every service call
How does a canary release work with a mesh?
- AA small traffic share goes to the new version — it grows gradually as health metrics stay green
- BThe new version replaces all Pods at once — the mesh rolls back if startup probes fail
- CThe new version runs in a separate cluster — DNS switches over after a long soak period
- DBoth versions process every request — responses are compared and the faster one wins
Which class of attack remains possible even with mesh mTLS everywhere?
- AApplication-level exploits — SQL injection in a request rides the encrypted channel intact
- BTraffic sniffing on the node network — packet captures reveal payloads between the Pods
- CService impersonation inside the mesh — any Pod can present another workload's identity
- DMan-in-the-middle between sidecars — intermediaries can silently rewrite the requests
What is the mesh's role in distributed tracing?
- AProxies create spans for each hop — but apps must forward trace headers between calls
- BProxies trace everything alone — the applications need no involvement whatsoever
- CProxies sample logs into traces — text lines are stitched together by timestamp
- DProxies only label the metrics — actual traces require a language-specific agent
Under mesh-wide mTLS, adding a DestinationRule starts returning 503s. What is the usual cause?
- AIts traffic policy defaults TLS to DISABLE, so the client now sends plaintext
- BIts subsets carry no matching labels, so the client has nowhere to send traffic
- CIts connection-pool limit trips before the first request has time to complete
- DIt picks a locality load-balancer setting the cluster cannot resolve
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
Why service mesh is worth your time
Platform-level superpowers
mTLS, canary routing and golden-signal metrics for every service without changing application code — once you know how to wield them.
Zero-trust, in practice
Workload identity and authorization policies are how modern clusters drop the "trusted internal network" assumption.
Resilience by configuration
Circuit breaking, outlier ejection and retry budgets tame cascading failures — if you understand what each knob really does.
A senior-level differentiator
Mesh architecture questions (sidecar vs ambient, ON-path vs control plane) are staples of platform and SRE interviews.
Common questions
Do I need Kubernetes knowledge first? +
Yes — the track assumes you are comfortable with Pods, Services and Deployments. The Kubernetes tracks cover those fundamentals if you need them first.
Is this Istio-specific or Linkerd-specific? +
Mostly neither: the concept modules hold across implementations and name Istio or Linkerd where they genuinely differ (Envoy sidecars vs micro-proxies, ambient mode, Viz extension). The installation and troubleshooting modules are Istio-specific by design, since Helm charts, revisions, ambient components and istioctl have no vendor-neutral equivalent.
Is it free? +
Yes, completely free. No registration or credit card is required, and all your progress is stored locally in your browser.
Does my team actually need a mesh? +
Not always — and the track says so. One of the concepts covered is when a mesh is overkill and plain Kubernetes Services with NetworkPolicies are the better call.
Ready to master service mesh?
Plant your first seed today. Ten minutes a day is all it takes to turn mesh buzzwords into working knowledge.