ICA Practice Questions

# Create namespace
kubectl create namespace webapp
kubectl label namespace webapp istio-injection=enabled

# Deploy httpbin as sample app
kubectl apply -n webapp -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl wait --for=condition=ready pod -l app=httpbin -n webapp --timeout=120s

# Get ingress gateway IP
kubectl get svc istio-ingressgateway -n istio-system

# Task 1: Create Gateway
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: webapp-gateway
  namespace: webapp
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "webapp.example.com"
EOF

# Task 2: Create VirtualService
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: webapp-vs
  namespace: webapp
spec:
  hosts:
  - "webapp.example.com"
  gateways:
  - webapp-gateway
  http:
  - route:
    - destination:
        host: httpbin
        port:
          number: 8000
EOF

# Verify resources
kubectl get gateway,virtualservice -n webapp

# Task 3: Get ingress IP and test
INGRESS_IP=$(kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
# If no external IP (e.g., minikube), use NodePort:
[ -z "$INGRESS_IP" ] && INGRESS_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
INGRESS_PORT=$(kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')

# Test with Host header
curl -s -H "Host: webapp.example.com" "http://${INGRESS_IP}:${INGRESS_PORT:-80}/headers" | head -20

kubectl delete namespace webapp

# Create namespace
kubectl create namespace canary-test
kubectl label namespace canary-test istio-injection=enabled

# Deploy v1
kubectl apply -n canary-test -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
      version: v1
  template:
    metadata:
      labels:
        app: myapp
        version: v1
    spec:
      containers:
      - name: myapp
        image: hashicorp/http-echo
        args: ["-text=v1"]
        ports:
        - containerPort: 5678
EOF

# Deploy v2
kubectl apply -n canary-test -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
      version: v2
  template:
    metadata:
      labels:
        app: myapp
        version: v2
    spec:
      containers:
      - name: myapp
        image: hashicorp/http-echo
        args: ["-text=v2"]
        ports:
        - containerPort: 5678
EOF

# Create service (selects both versions)
kubectl apply -n canary-test -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 5678
EOF

# Deploy test client
kubectl apply -n canary-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml
kubectl wait --for=condition=ready pod -l app=sleep -n canary-test --timeout=120s

# Task 1: Create DestinationRule with subsets
kubectl apply -n canary-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: myapp-dr
spec:
  host: myapp
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
EOF

# Task 2: Create VirtualService with 90/10 split
kubectl apply -n canary-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myapp-vs
spec:
  hosts:
  - myapp
  http:
  - route:
    - destination:
        host: myapp
        subset: v1
      weight: 90
    - destination:
        host: myapp
        subset: v2
      weight: 10
EOF

# Verify resources
kubectl get destinationrule,virtualservice -n canary-test

# Task 3: Test traffic distribution (run 20 requests)
echo "Testing traffic split (20 requests)..."
for i in {1..20}; do
  kubectl exec -n canary-test deploy/sleep -- curl -s myapp:80
done | sort | uniq -c

kubectl delete namespace canary-test

# Create namespace and deploy httpbin
kubectl create namespace fault-test
kubectl label namespace fault-test istio-injection=enabled

kubectl apply -n fault-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n fault-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n fault-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n fault-test --timeout=120s

# Test baseline response time
echo "Baseline response time:"
kubectl exec -n fault-test deploy/sleep -- time curl -s httpbin:8000/get -o /dev/null

# Task 1: Create VirtualService with fault delay
kubectl apply -n fault-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin-delay
spec:
  hosts:
  - httpbin
  http:
  - fault:
      delay:
        percentage:
          value: 50
        fixedDelay: 5s
    route:
    - destination:
        host: httpbin
        port:
          number: 8000
EOF

# Verify
kubectl get virtualservice -n fault-test

# Task 2: Test multiple requests (observe ~50% with 5s delay)
echo "Testing fault injection (5 requests)..."
for i in {1..5}; do
  echo "Request $i:"
  kubectl exec -n fault-test deploy/sleep -- sh -c 'time curl -s httpbin:8000/get -o /dev/null 2>&1 | grep real'
done

kubectl delete namespace fault-test

kubectl create namespace abort-test
kubectl label namespace abort-test istio-injection=enabled

kubectl apply -n abort-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n abort-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n abort-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n abort-test --timeout=120s

# Verify baseline works
kubectl exec -n abort-test deploy/sleep -- curl -sI httpbin:8000/status/200 | head -1

# Task 1: Create VirtualService with abort fault
kubectl apply -n abort-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin-abort
spec:
  hosts:
  - httpbin
  http:
  - fault:
      abort:
        percentage:
          value: 100
        httpStatus: 503
    route:
    - destination:
        host: httpbin
        port:
          number: 8000
EOF

# Task 2: Test (all requests should return 503)
echo "Testing abort fault injection..."
for i in {1..3}; do
  kubectl exec -n abort-test deploy/sleep -- curl -sI httpbin:8000/get | head -1
done

kubectl delete namespace abort-test

kubectl create namespace timeout-test
kubectl label namespace timeout-test istio-injection=enabled

kubectl apply -n timeout-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n timeout-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n timeout-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n timeout-test --timeout=120s

# Test slow endpoint (5s delay) - should work without timeout
echo "Testing 5s delay endpoint (no timeout configured):"
kubectl exec -n timeout-test deploy/sleep -- curl -s httpbin:8000/delay/5 -o /dev/null -w "Status: %{http_code}, Time: %{time_total}s\n"

# Task 1: Create VirtualService with 3s timeout
kubectl apply -n timeout-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin-timeout
spec:
  hosts:
  - httpbin
  http:
  - timeout: 3s
    route:
    - destination:
        host: httpbin
        port:
          number: 8000
EOF

# Task 2: Test slow endpoint (5s) - should timeout after 3s
echo "Testing 5s delay with 3s timeout (should fail):"
kubectl exec -n timeout-test deploy/sleep -- curl -s httpbin:8000/delay/5 -o /dev/null -w "Status: %{http_code}, Time: %{time_total}s\n"

# Task 3: Test fast endpoint - should succeed
echo "Testing fast endpoint (should succeed):"
kubectl exec -n timeout-test deploy/sleep -- curl -s httpbin:8000/get -o /dev/null -w "Status: %{http_code}, Time: %{time_total}s\n"

kubectl delete namespace timeout-test

kubectl create namespace retry-test
kubectl label namespace retry-test istio-injection=enabled

kubectl apply -n retry-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n retry-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n retry-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n retry-test --timeout=120s

# Task 1: Create VirtualService with retries
kubectl apply -n retry-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin-retry
spec:
  hosts:
  - httpbin
  http:
  - retries:
      attempts: 3
      perTryTimeout: 2s
      retryOn: 5xx,reset,connect-failure,retriable-4xx
    route:
    - destination:
        host: httpbin
        port:
          number: 8000
EOF

# Verify configuration
kubectl get virtualservice httpbin-retry -n retry-test -o yaml | grep -A5 retries

# Task 2: Test with normal request
kubectl exec -n retry-test deploy/sleep -- curl -s httpbin:8000/get | head -5

# Test with 500 error endpoint (Istio will retry)
echo "Testing 500 endpoint (retries will occur but still fail):"
kubectl exec -n retry-test deploy/sleep -- curl -sI httpbin:8000/status/500 | head -1

kubectl delete namespace retry-test

kubectl create namespace circuit-test
kubectl label namespace circuit-test istio-injection=enabled

kubectl apply -n circuit-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n circuit-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n circuit-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n circuit-test --timeout=120s

# Task 1: Create DestinationRule with circuit breaker
kubectl apply -n circuit-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: httpbin-cb
spec:
  host: httpbin
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 1
      http:
        http1MaxPendingRequests: 1
        http2MaxRequests: 1
        maxRequestsPerConnection: 1
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 100
EOF

# Verify configuration
kubectl get destinationrule httpbin-cb -n circuit-test -o yaml | grep -A10 connectionPool

# Task 2: Test with concurrent requests (using fortio if available, or simple loop)
echo "Testing circuit breaker with rapid requests..."
for i in {1..10}; do
  kubectl exec -n circuit-test deploy/sleep -- curl -s httpbin:8000/get -o /dev/null -w "%{http_code}\n" &
done
wait

kubectl delete namespace circuit-test

kubectl create namespace mirror-test
kubectl label namespace mirror-test istio-injection=enabled

# Deploy v1 and v2 httpbin instances
kubectl apply -n mirror-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml

# Create v2 deployment
kubectl apply -n mirror-test -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin-v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v2
  template:
    metadata:
      labels:
        app: httpbin
        version: v2
    spec:
      containers:
      - name: httpbin
        image: docker.io/kong/httpbin
        ports:
        - containerPort: 80
EOF

# Label original deployment as v1
kubectl patch deployment httpbin -n mirror-test --type merge -p '{"spec":{"template":{"metadata":{"labels":{"version":"v1"}}}}}'

kubectl apply -n mirror-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml
kubectl wait --for=condition=ready pod -l app=httpbin -n mirror-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n mirror-test --timeout=120s

# Task 1: Create DestinationRule
kubectl apply -n mirror-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: httpbin-dr
spec:
  host: httpbin
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
EOF

# Task 2: Create VirtualService with mirroring
kubectl apply -n mirror-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin-mirror
spec:
  hosts:
  - httpbin
  http:
  - route:
    - destination:
        host: httpbin
        subset: v1
    mirror:
      host: httpbin
      subset: v2
    mirrorPercentage:
      value: 100
EOF

# Task 3: Generate traffic
echo "Generating traffic..."
for i in {1..5}; do
  kubectl exec -n mirror-test deploy/sleep -- curl -s httpbin:8000/headers -o /dev/null
done

# Check v2 logs for mirrored requests
echo "Checking v2 logs for mirrored traffic:"
kubectl logs -n mirror-test deploy/httpbin-v2 --tail=10

kubectl delete namespace mirror-test

kubectl create namespace header-test
kubectl label namespace header-test istio-injection=enabled

# Deploy two versions
kubectl apply -n header-test -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
      version: v1
  template:
    metadata:
      labels:
        app: myapp
        version: v1
    spec:
      containers:
      - name: app
        image: hashicorp/http-echo
        args: ["-text=v1-standard"]
        ports:
        - containerPort: 5678
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
      version: v2
  template:
    metadata:
      labels:
        app: myapp
        version: v2
    spec:
      containers:
      - name: app
        image: hashicorp/http-echo
        args: ["-text=v2-premium"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 5678
EOF

kubectl apply -n header-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml
kubectl wait --for=condition=ready pod -l app=myapp -n header-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n header-test --timeout=120s

# Task 1: Create DestinationRule
kubectl apply -n header-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: myapp-dr
spec:
  host: myapp
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
EOF

# Task 2: Create VirtualService with header match
kubectl apply -n header-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myapp-vs
spec:
  hosts:
  - myapp
  http:
  - match:
    - headers:
        x-user-type:
          exact: premium
    route:
    - destination:
        host: myapp
        subset: v2
  - route:
    - destination:
        host: myapp
        subset: v1
EOF

# Task 3: Test routing
echo "Request WITHOUT header (should get v1):"
kubectl exec -n header-test deploy/sleep -- curl -s myapp:80

echo ""
echo "Request WITH premium header (should get v2):"
kubectl exec -n header-test deploy/sleep -- curl -s -H "x-user-type: premium" myapp:80

kubectl delete namespace header-test

kubectl create namespace uri-test
kubectl label namespace uri-test istio-injection=enabled

# Deploy httpbin as backend
kubectl apply -n uri-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n uri-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n uri-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n uri-test --timeout=120s

# Task 1 & 2: Create VirtualService with URI match and rewrite
kubectl apply -n uri-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin-uri
spec:
  hosts:
  - httpbin
  http:
  - match:
    - uri:
        prefix: /api/v1/
    rewrite:
      uri: /
    route:
    - destination:
        host: httpbin
        port:
          number: 8000
  - match:
    - uri:
        prefix: /api/v2/
    rewrite:
      uri: /
    route:
    - destination:
        host: httpbin
        port:
          number: 8000
  - route:
    - destination:
        host: httpbin
        port:
          number: 8000
EOF

# Task 3: Test URI routing
echo "Testing /api/v1/get (rewrites to /get):"
kubectl exec -n uri-test deploy/sleep -- curl -s httpbin:8000/api/v1/get | head -5

echo ""
echo "Testing /api/v2/headers (rewrites to /headers):"
kubectl exec -n uri-test deploy/sleep -- curl -s httpbin:8000/api/v2/headers | head -5

echo ""
echo "Testing /get directly:"
kubectl exec -n uri-test deploy/sleep -- curl -s httpbin:8000/get | head -5

kubectl delete namespace uri-test

kubectl create namespace lb-test
kubectl label namespace lb-test istio-injection=enabled

kubectl apply -n lb-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl apply -n lb-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n lb-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n lb-test --timeout=120s

# Task 1: Create DestinationRule with load balancing
kubectl apply -n lb-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: httpbin-lb
spec:
  host: httpbin
  trafficPolicy:
    loadBalancer:
      simple: LEAST_REQUEST
EOF

# Task 2: Verify configuration
kubectl get destinationrule httpbin-lb -n lb-test -o yaml | grep -A3 loadBalancer

# Test requests
for i in {1..5}; do
  kubectl exec -n lb-test deploy/sleep -- curl -s httpbin:8000/get -o /dev/null -w "Request $i: %{http_code}\n"
done

kubectl delete namespace lb-test

kubectl create namespace sticky-test
kubectl label namespace sticky-test istio-injection=enabled

# Deploy multiple replicas
kubectl apply -n sticky-test -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml
kubectl scale deployment httpbin -n sticky-test --replicas=3

kubectl apply -n sticky-test -f https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml

kubectl wait --for=condition=ready pod -l app=httpbin -n sticky-test --timeout=120s
kubectl wait --for=condition=ready pod -l app=sleep -n sticky-test --timeout=120s

# Task 1: Create DestinationRule with consistent hash
kubectl apply -n sticky-test -f - <<EOF
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: httpbin-sticky
spec:
  host: httpbin
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpHeaderName: x-user-id
EOF

# Task 2: Test sticky sessions
echo "Requests with x-user-id: user-123 (should hit same pod):"
for i in {1..3}; do
  kubectl exec -n sticky-test deploy/sleep -- curl -s -H "x-user-id: user-123" httpbin:8000/headers | grep -i "pod\|host"
done

echo ""
echo "Requests with x-user-id: user-456 (may hit different pod):"
for i in {1..3}; do
  kubectl exec -n sticky-test deploy/sleep -- curl -s -H "x-user-id: user-456" httpbin:8000/headers | grep -i "pod\|host"
done

kubectl delete namespace sticky-test