What is Istio?

Learn that Istio is a service mesh implementation.

What is Istio?

Istio has two layers:

The control plane (istiod): reads the configuration (VirtualService, DestinationRule, policies), distributes certificates and sends configuration to the proxies.
The data plane: the Envoy proxies in each pod; they actually carry the traffic.

To add a namespace to the mesh it is labelled; new pods created in that namespace get the sidecar automatically:

kubectl label namespace magaza istio-injection=enabled
kubectl rollout restart deployment -n magaza
kubectl get pods -n magaza
NAME                  READY   STATUS
api-6b5c4d3e2-abcde   2/2     Running     # app + istio-proxy

Checking the mesh

istioctl shows the mesh's state and possible configuration errors:

$ istioctl proxy-status
NAME                              CLUSTER     CDS     LDS     EDS     RDS     ISTIOD
api-6b5c4d3e2-abcde.magaza        Kubernetes  SYNCED  SYNCED  SYNCED  SYNCED  istiod-7b9c…
$ istioctl analyze -n magaza
✔ No validation issues found when analyzing namespace: magaza.

Exercise Add the namespace to the mesh

Write four commands: add the label istio-injection=enabled to the magaza namespace; restart all deployments in magaza; list the pods in magaza; run istioctl analyze -n magaza.

Show example solution

kubectl label namespace magaza istio-injection=enabled
kubectl rollout restart deployment -n magaza
kubectl get pods -n magaza
istioctl analyze -n magaza

Test yourself

Why are the existing pods restarted after the namespace is labelled?
- istiod crashes
- The sidecar is only added when a pod is created (admission)
- The label deletes the pods
- It isn't needed
Show answer

The sidecar is only added when a pod is created (admission) — Injection is a mutating admission webhook.

Turn on automatic sidecar injection for the namespace.

kubectl label namespace magaza ____=enabled

Show answer

kubectl label namespace magaza istio-injection=enabled

Match.

istiod

Control plane
Envoy

Data plane
2/2

App + proxy
istioctl analyze

Configuration check

Next lesson: Envoy sidecar

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies