Skip to content
ICATraffic ManagementSingle nodeEasy

Expose a service through the ingress gateway

Scenario ica-trf-001 · about 7 minutes · 7 points · 4 grader checks

Publish an in-mesh HTTP service on a host name through the Istio ingress gateway with a Gateway and a VirtualService.

  • gateway
  • virtualservice
  • ingress
  • traffic-management

What you will practise

  • Configure a Gateway on the default ingress gateway
  • Bind a VirtualService to a Gateway
  • Test ingress routing with a Host header

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-trf-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed (default profile). The Service "frontend" in namespace "store" (port 8000, in the mesh) must be reachable from outside the mesh as http://store.example.com/ through the default ingress gateway (the pods labelled istio=ingressgateway in "istio-system"). 1. Create a Gateway "store-gateway" in namespace "store" that accepts HTTP on port 80 for host "store.example.com" on the default ingress gateway. 2. Create a VirtualService "frontend" in namespace "store", bound to "store-gateway", that routes all requests for "store.example.com" to the Service "frontend" on port 8000. Requests to the ingress gateway for any other host name must not reach "frontend".

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Traffic Management
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
7 minutes
Points
7
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Traffic Management labs

ICATraffic ManagementMedium

Route requests by header to a service version

Define service subsets and send requests of one user to v2 while everybody else stays on v1.

Single node · ~8 min · 8 points

  • virtualservice
  • destinationrule
  • subsets
  • header-routing
  • traffic-management

goldenkube start ica-trf-002

ICATraffic ManagementEasy

Shift 20 percent of traffic to a new version

Split traffic between two versions of a service with weighted routes.

Single node · ~7 min · 6 points

  • traffic-shifting
  • weights
  • virtualservice
  • destinationrule
  • traffic-management

goldenkube start ica-trf-003

ICATraffic ManagementMedium

Lock down egress and register one external host

Switch the mesh to registry-only outbound traffic and allow exactly one external host with a ServiceEntry.

Single node · ~9 min · 9 points

  • egress
  • serviceentry
  • outbound-traffic-policy
  • meshconfig
  • traffic-management

goldenkube start ica-trf-004

ICATraffic ManagementMedium

Timeouts, retries and circuit breaking

Make a slow backend fail fast with a timeout and retries, and protect it with a connection pool and outlier detection.

Single node · ~10 min · 10 points

  • resilience
  • timeout
  • retries
  • circuit-breaking
  • outlier-detection
  • traffic-management

goldenkube start ica-trf-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.