Challenge - Expert project
- Docker & Kubernetes course
- Expert
- Lesson 47/47
- 6 min
Set up a project combining CRD, Operator and Istio.
Challenge: the expert project
In the final challenge you'll combine the pieces of the expert section. For the magaza application:
- a nightly database backup with the
YedekCRD and its operator, - mandatory mTLS and canary routing with Istio,
- mandatory labels and the latest ban with Gatekeeper,
- a namespace backup and a restore drill with Velero.
magaza namespace
├─ istio-injection=enabled + PeerAuthentication STRICT
├─ Yedek magaza-db (operator -> CronJob)
├─ Constraints (takim/ortam labels, latest ban)
└─ Velero schedule gece (720h)Practice Mesh and mTLS
First write two commands that add the istio-injection=enabled label to the magaza namespace and restart the deployments (kubectl rollout restart deploy -n magaza). Then write a PeerAuthentication YAML: security.istio.io/v1; name default, namespace magaza; spec.mtls.mode: STRICT.
Starter code
# buraya yazSample solution
kubectl label namespace magaza istio-injection=enabled
kubectl rollout restart deploy -n magaza
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
name: default
namespace: magaza
spec:
mtls:
mode: STRICTExpected output
namespace/magaza labeled deployment.apps/api restarted deployment.apps/web restarted peerauthentication.security.istio.io/default created
Practice Checklist
Write four commands verifying the setup: list the Yedek objects in magaza (kubectl get yd -n magaza); list all Constraints; list the Velero schedules; analyse the Istio configuration of the magaza namespace (istioctl analyze -n magaza).
Starter code
# buraya yazSample solution
kubectl get yd -n magaza
kubectl get constraints
velero schedule get
istioctl analyze -n magazaExpected output
NAME AGE magaza-db 2d NAME ENFORCEMENT-ACTION TOTAL-VIOLATIONS deployment-etiketleri deny 0 latest-yasak deny 0 NAME STATUS CREATED SCHEDULE BACKUP TTL gece Enabled 2026-11-01 10:20:00 +0300 +03 0 2 * * * 720h0m0s ✔ No validation issues found when analyzing namespace: magaza.
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 After adding the istio-injection label, how is the sidecar added to existing pods?
- By restarting the deployments (rollout restart) Correct answer
- It's added immediately on its own
- With istioctl delete
- It can't be added
Explanation: Injection happens when the pod is created.
2 Enable sidecar injection in the namespace.
kubectl label namespace magaza ____=enabledkubectl label namespace magaza istio-injection=enabledExplanation: The label adds Envoy to new pods.
3 Match.
| Term | Meaning |
|---|---|
PeerAuthentication |
mTLS requirement |
Yedek |
Database backup request |
Constraint |
Policy enforcement |
velero schedule |
Namespace backup |