Summary - Service mesh

Combine sidecar and VirtualService to write a mesh rule.

Summary: service mesh

In this group:

A service mesh manages traffic between services without code: traffic, security, observability.
Istio: istiod (control plane) + Envoy (data plane); a namespace joins the mesh with istio-injection=enabled.
The sidecar takes traffic transparently with iptables; its resources are set with annotations.
DestinationRule (subsets, circuit breaking) + VirtualService (weights, retries, timeouts) enable canaries.
PeerAuthentication manages mTLS (PERMISSIVE → STRICT); AuthorizationPolicy is an identity-based access rule.

istioctl analyze -n magaza
istioctl proxy-status

Exercise Version subsets

Write a DestinationRule YAML: networking.istio.io/v1; name api; host: api; two subsets: v1 (labels.surum: v1) and v2 (labels.surum: v2).

Show example solution

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: api
spec:
  host: api
  subsets:
    - name: v1
      labels:
        surum: v1
    - name: v2
      labels:
        surum: v2

Test yourself

If the canary version errors at 10% of traffic, what is the fastest way back?
- Removing the namespace label
- Setting the v2 weight to 0 in the VirtualService
- Restarting the cluster
- Deleting istiod
Show answer

Setting the v2 weight to 0 in the VirtualService — The pods stay untouched; only the routing changes.

Write the setting that ejects a failing instance.

  trafficPolicy:
    ____:
      consecutive5xxErrors: 5

Show answer

  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 5

Match.

VirtualService

Where to go
DestinationRule

How to connect
PeerAuthentication

mTLS mode
AuthorizationPolicy

Who can access

Next lesson: What is multi-cluster?

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies