Interview › Istio & Service Mesh
What are subsets in a DestinationRule, and how are they used?
Istio & Service Mesh · Basic level
Answer
Subsets are named groups of endpoints for a service, usually selected by pod labels such as version: v1 or version: v2. They are defined in a DestinationRule and then referenced by VirtualService routes.
Technical explanation
Subsets let routing policy target logical versions without creating separate Kubernetes Services for every release.
Each subset can have its own traffic policy, such as load balancing, connection pools, or TLS settings.
The pod labels must match exactly, otherwise the subset has no endpoints and routing can fail with 503-style errors.
Hands-on example
Validate subset endpoints:
$ kubectl get pods -n app -l app=reviews --show-labels
$ istioctl proxy-config endpoints deploy/productpage -n app | grep reviews
If subset v2 has no endpoints, fix deployment labels or DestinationRule subset labels before changing retry policy.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Istio & Service Mesh interview questions
- What is Istio, and what are the core capabilities it provides?
- What is the difference between the Istio control plane and data plane?
- What is istiod, and what does it do?
- What is Envoy, and what role does it play in Istio?
- What is the sidecar pattern, and how does Istio inject the proxy?
- How does automatic sidecar injection work (namespace label, webhook)?
- What is the Istio ambient (sidecarless) mode, and how does it differ from sidecar mode?
- What is the difference between ztunnel and a waypoint proxy in ambient mode?