Istio applies traffic policy, identity, telemetry, and security policy to workloads through Envoy proxies and control-plane configuration. Adopt it only when those cross-cutting requirements justify the additional operational surface.
Data Plane and Control Plane #
The data plane consists of Envoy sidecars or an ambient deployment with a
per-node ztunnel and optional waypoint proxies. istiod computes and distributes
service discovery, certificates, and traffic configuration through xDS. A
workload path captures inbound and outbound traffic according to the selected
mode; traffic that bypasses that path cannot be governed by mesh policy. Ambient
mode and sidecars have different L4/L7 enforcement placement, so migration must
verify where each policy executes.
Traffic Management #
Gateway and VirtualService resources define ingress listeners and routing
rules. DestinationRule defines subsets, load-balancing, connection, and TLS
policy for a destination. Route by stable labels such as version, and ensure
that the labels used by subsets are present on workloads.
Weighted routes can shift a measured percentage from a stable subset to a canary. Header or identity matches can direct test traffic first. Gate each change on proxy configuration convergence and workload health; route weights do not compensate for missing endpoints or an incorrect subset selector.
Retries, timeouts, circuit breakers, and fault injection change failure behavior. Set budgets according to the caller’s deadline; an unrestricted retry policy can amplify overload and duplicate non-idempotent work.
Identity and Security #
Istio issues workload identities based on Kubernetes service accounts and can
use mutual TLS between proxies. Enforce authorization with AuthorizationPolicy
after verifying that every required workload participates in the mesh. Start
with permissive migration only to find unmanaged traffic, then move to strict
mutual TLS with an explicit migration plan.
Use PeerAuthentication for mTLS posture, RequestAuthentication to validate
end-user JWTs where needed, and AuthorizationPolicy for access decisions.
Workload identity does not replace application authorization for tenant or
business permissions.
istiod acts as the certificate authority or integrates with an external CA,
then rotates short-lived workload certificates before expiry. Monitor issuance,
root transitions, trust-domain configuration, and clock skew. During a root
rotation, distribute overlapping trust before replacing leaf certificates so
old and new workloads can authenticate each other.
Operations #
Version the mesh control plane and data plane deliberately, review analyzer
output before rollout, and monitor proxy resource use, certificate expiration,
and configuration convergence. Use istioctl proxy-status and
istioctl proxy-config to diagnose what a proxy received instead of relying on
the YAML that was intended to apply.
Envoy emits request metrics, access logs, and traces according to telemetry configuration. Preserve request IDs and sampling policy across ingress, waypoints or sidecars, and applications. Missing telemetry can mean traffic bypassed the proxy, configuration did not converge, or collection failed.
Control-plane health, data-plane health, and application health are separate failure domains. Existing proxies can continue with their last accepted configuration during a transient control-plane outage, but new endpoints, certificates, and policy changes can stall. Roll out by revision or bounded workload set, inspect rejected xDS updates and proxy versions, and retain a tested rollback path.
Comments
Read or comment on GitHub (sign-in required to comment)