Summary - Service mesh
- Docker & Kubernetes course
- Expert
- Lesson 24/47
- 5 min
Combine sidecar and VirtualService to write a mesh rule.
Summary: service mesh
In this group:
- A service mesh manages traffic between services without code: traffic, security, observability.
- Istio:
istiod(control plane) + Envoy (data plane); a namespace joins the mesh withistio-injection=enabled. - The sidecar takes traffic transparently with iptables; its resources are set with annotations.
- DestinationRule (subsets, circuit breaking) + VirtualService (weights, retries, timeouts) enable canaries.
- PeerAuthentication manages mTLS (PERMISSIVE → STRICT); AuthorizationPolicy is an identity-based access rule.
istioctl analyze -n magaza
istioctl proxy-statusPractice Version subsets
Write a DestinationRule YAML: networking.istio.io/v1; name api; host: api; two subsets: v1 (labels.surum: v1) and v2 (labels.surum: v2).
Starter code
# buraya yazSample solution
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
name: api
spec:
host: api
subsets:
- name: v1
labels:
surum: v1
- name: v2
labels:
surum: v2Expected output
destinationrule.networking.istio.io/api created
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 If the canary version errors at 10% of traffic, what is the fastest way back?
- Removing the namespace label
- Setting the v2 weight to 0 in the VirtualService Correct answer
- Restarting the cluster
- Deleting istiod
Explanation: The pods stay untouched; only the routing changes.
2 Write the setting that ejects a failing instance.
Question
trafficPolicy:
____:
consecutive5xxErrors: 5
Answer
trafficPolicy:
outlierDetection:
consecutive5xxErrors: 5Explanation: outlierDetection is Istio's circuit breaker.
3 Match.
| Term | Meaning |
|---|---|
VirtualService |
Where to go |
DestinationRule |
How to connect |
PeerAuthentication |
mTLS mode |
AuthorizationPolicy |
Who can access |