Istio: Weaving the Service Mesh [I]
summary
Istio wires Envoy sidecars into every pod to provide zero code change service-level features: consistent metrics, OpenTracing spans, traffic splitting (down to 0.1%), and policy. A control plane of pilot + mixer + citadel programs proxies, enforces cached policies (so mixer is not in the hot path), and issues x.509 identities for mutual TLS with fast cert rotation to limit blast radius. Works on Kubernetes and mixed VM migrations; Envoy is proven at Lyft scale (20k VMs, ~5M req/s).
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:49The Service Mesh
- 7:21Sidecars
- 12:24Preferred Sidecar
- 14:06Visibility Observability Metrics
- 16:54Traffic Splitting
- 18:34Expanding the Service Mesh
- 20:29Security
- 23:31Geo
- 27:54Roadmap
related talks
48mIstio An open platform to connect, manage, and secure microservices
42mIstio: Weaving, Securing and Observing microservices
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
42mSecuring Kubernetes Workloads with Istio Service Mesh
46mStop reinventing the wheel with Istio
46mIstio and API Management Integration with Envoy WeAssembly Extensions
29mYou Probably DON’T Need a Service Mesh!
28mRed Light, Green Light: Traffic Security in the Service Mesh with Istio