Istio

Running a service mesh on Kubernetes with Istio.

Quick Start

istioctl install --set profile=default
kubectl label namespace default istio-injection=enabled

When to Use

• Mutual TLS across services
• Fine-grained traffic routing and canaries
• Uniform telemetry (metrics, traces, logs)
• Resilience policies (timeouts, retries, circuit breakers)

Best Practices

Traffic Management

• Define VirtualServices for routing rules
• Use DestinationRules for subsets and load balancing
• Prefer canary via weight splits
• Keep rules explicit and reviewable

Security

• Enable mTLS across the mesh
• Use PeerAuthentication for encryption
• Authorize with AuthorizationPolicy
• Use SPIFFE identities for services

Observability

• Enable Prometheus metrics via sidecars
• Use Kiali for topology
• Add distributed tracing (Jaeger/Tempo)
• Monitor request volume, latency, and errors

Resiliency

• Set timeouts and retries in VirtualServices
• Add circuit breakers via DestinationRules
• Test failure with fault injection
• Keep fail-open defaults for low-risk paths

Dependencies

istioctl install --set profile=default
kubectl label namespace default istio-injection=enabled

Examples

# VirtualService with canary split
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata: { name: web }
spec:
  hosts: [web]
  http:
    - route:
        - destination: { host: web, subset: stable }
          weight: 90
        - destination: { host: web, subset: canary }
          weight: 10

# DestinationRule subsets + circuit breaker
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata: { name: web }
spec:
  host: web
  subsets:
    - name: stable
      labels: { version: v1 }
    - name: canary
      labels: { version: v2 }
  trafficPolicy:
    connectionPool:
      tcp: { maxConnections: 100 }
    outlierDetection:
      consecutive5xxErrors: 5

# AuthorizationPolicy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata: { name: require-jwt }
spec:
  action: ALLOW
  rules:
    - from:
        - source: { requestPrincipals: ["*"] }

# mTLS peer authentication
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata: { name: default }
spec:
  mtls:
    mode: STRICT

Step-by-Step

1. Install Istio and enable sidecar injection.

2. Label namespaces for injection.

3. Add DestinationRules with subsets.

4. Create VirtualServices for routing/canaries.

5. Enable mTLS and AuthorizationPolicies.

6. Turn on telemetry and tracing.

7. Add timeouts, retries, and circuit breakers.

8. Monitor with Kiali and dashboards.

Validation

1. Sidecars are injected and healthy

2. mTLS encrypts service-to-service traffic

3. Canary splits route the correct weight

4. AuthorizationPolicy blocks unauthorized calls

5. Metrics/traces flow for all services

Troubleshooting

• Sidecar not injected: check namespace label and restart pods.
• Routing wrong: review VirtualService host and subset labels.
• mTLS issues: check PeerAuthentication mode and certs.