What is Istio?
- Docker & Kubernetes course
- Expert
- Lesson 20/47
- 4 min
Learn that Istio is a service mesh implementation.
What is Istio?
Istio has two layers:
- The control plane (
istiod): reads the configuration (VirtualService, DestinationRule, policies), distributes certificates and sends configuration to the proxies. - The data plane: the Envoy proxies in each pod; they actually carry the traffic.
To add a namespace to the mesh it is labelled; new pods created in that namespace get the sidecar automatically:
kubectl label namespace magaza istio-injection=enabled
kubectl rollout restart deployment -n magaza
kubectl get pods -n magaza
NAME READY STATUS
api-6b5c4d3e2-abcde 2/2 Running # app + istio-proxyChecking the mesh
istioctl shows the mesh's state and possible configuration errors:
$ istioctl proxy-status
NAME CLUSTER CDS LDS EDS RDS ISTIOD
api-6b5c4d3e2-abcde.magaza Kubernetes SYNCED SYNCED SYNCED SYNCED istiod-7b9c…
$ istioctl analyze -n magaza
✔ No validation issues found when analyzing namespace: magaza.Practice Add the namespace to the mesh
Write four commands: add the label istio-injection=enabled to the magaza namespace; restart all deployments in magaza; list the pods in magaza; run istioctl analyze -n magaza.
Starter code
# buraya yazSample solution
kubectl label namespace magaza istio-injection=enabled
kubectl rollout restart deployment -n magaza
kubectl get pods -n magaza
istioctl analyze -n magazaExpected output
namespace/magaza labeled deployment.apps/api restarted deployment.apps/web restarted NAME READY STATUS RESTARTS AGE api-6b5c4d3e2-abcde 2/2 Running 0 20s web-5a4b3c2d1-fghij 2/2 Running 0 20s ✔ No validation issues found when analyzing namespace: magaza.
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Why are the existing pods restarted after the namespace is labelled?
- istiod crashes
- The sidecar is only added when a pod is created (admission) Correct answer
- The label deletes the pods
- It isn't needed
Explanation: Injection is a mutating admission webhook.
2 Turn on automatic sidecar injection for the namespace.
Question
kubectl label namespace magaza ____=enabled
Answer
kubectl label namespace magaza istio-injection=enabledExplanation: istio-injection=enabled turns injection on.
3 Match.
| Term | Meaning |
|---|---|
istiod |
Control plane |
Envoy |
Data plane |
2/2 |
App + proxy |
istioctl analyze |
Configuration check |