Istio to the rescue
summary
Istio wires Envoy sidecars next to pods and uses an istiod control plane to push routing, retries, timeouts, circuit breaking, and fault injection so services gain virtual services and mutual TLS without code changes. Examples: weighted traffic splits (75/25), injectible delays and aborts for chaos, JWT request auth plus namespace-level authorization, and Zipkin/Lightstep/Datadog tracing with adjustable sampling. It works but adds per-pod CPU/memory, an extra network hop, and more control-plane services to operate.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:26The great transition
- 2:36Why do we do it?
- 5:35Mesh what?
- 6:22Sidecar proxy
- 7:47Service Mesh
- 10:50Istio Architecture
- 11:19Envoy
- 12:09Istiod
- 13:35Traffic Management: Virtual Service
- 15:30Traffic Management: Destination Rule
- 16:50Traffic Management: Gateway
- 18:02Traffic Management: Service Entry
- 19:22Traffic Management Network Resilience
- 20:11Traffic Management: Fault Injection
- 22:17Security: Architecture
- 23:15Security: Authentication
- 24:27Security: Peer Authentication
- 25:11Security: Request Authentication
- 26:48Security: Authorization Policies
- 30:51Observability: Distributed traces
- 32:02Observability: Logs
- 32:51Is it all sunshine and rainbows?
- 34:33Thank you!
related talks
48mIstio An open platform to connect, manage, and secure microservices
01h 06mIstio on Kubernetes: Smart Canaries, Dark Launches and Chaos
40mIstio, your K8S cluster best friend
47mIstio, le meilleur ami de votre cluster K8S
42mIstio: Weaving, Securing and Observing microservices
33mMircoservices the right way: an introduction to Istio
55mEmpower Your Microservices with Istio Service Mesh
46mIstioD - from microservices to monolithic