Interview › Istio & Service Mesh
Does the data plane keep working if the control plane goes down, and why?
Istio & Service Mesh · Intermediate level
Answer
Yes, the data plane can keep serving existing traffic if the control plane goes down because Envoy proxies already have their last accepted configuration. However, they cannot receive new routes, endpoints, certificates, or policy updates until control-plane connectivity is restored.
Technical explanation
This separation is an important resilience property of the mesh.
It does not mean the control plane is optional; prolonged outage can affect scaling, rotations, and rollout safety.
Gateways and sidecars should be monitored separately from istiod so teams know whether they have a control-plane issue or a data-plane issue.
Hands-on example
Operational check:
$ istioctl proxy-status
If proxies show connected and synced, traffic problems are likely data-plane or app-specific.
If proxies are disconnected but traffic still works, avoid risky config changes until istiod is restored and proxies resync.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Istio & Service Mesh interview questions
- What is Istio, and what are the core capabilities it provides?
- What is the difference between the Istio control plane and data plane?
- What is istiod, and what does it do?
- What is Envoy, and what role does it play in Istio?
- What is the sidecar pattern, and how does Istio inject the proxy?
- How does automatic sidecar injection work (namespace label, webhook)?
- What is the Istio ambient (sidecarless) mode, and how does it differ from sidecar mode?
- What is the difference between ztunnel and a waypoint proxy in ambient mode?