Skip to content

Latest commit

 

History

History
78 lines (42 loc) · 5.84 KB

Istio.md

File metadata and controls

78 lines (42 loc) · 5.84 KB

Istio Cheatsheet

text

Overview

Istio is an open-source service mesh that layers transparently onto existing distributed applications. It provides a way to control how microservices share data with one another. Key features of Istio include traffic management, security, and observability.

Basic Concepts

  • Service Mesh: Istio creates a service mesh, which is an infrastructure layer that enables microservices to communicate with each other securely and efficiently. It also allows for traffic management and monitoring without requiring changes to the microservices themselves.

  • Control Plane vs. Data Plane: Istio's architecture is divided into two planes:

    • Control Plane: Manages and configures the proxies (Envoy) to route traffic, enforce policies, and collect telemetry.
    • Data Plane: Consists of Envoy proxies deployed as sidecars to the microservices, handling all network traffic between services.

Key Components

  • Envoy Proxy: The core component of Istio’s data plane. Envoy is deployed as a sidecar to each service and intercepts all inbound and outbound traffic.

  • Pilot: Manages the configuration of the Envoy proxies, distributing routing rules and policies across the mesh.

  • Mixer: Enforces access control and usage policies, and collects telemetry data. It interacts with the Envoy proxies and provides insights into traffic patterns and security.

  • Citadel: Manages certificates and keys for mutual TLS (mTLS) and service identities within the mesh, ensuring secure communication between services.

  • Galley: Istio’s configuration validation component. It ensures that configurations are correct and distributes them to the appropriate components within the mesh.

Traffic Management

  • VirtualService: A resource that defines how traffic is routed to a service. It allows you to configure complex routing rules like request matching, traffic splitting, and more.

  • DestinationRule: Defines policies that apply to traffic after it has been routed to a destination. These policies can include load balancing settings, connection pool sizes, and outlier detection.

  • Gateway: Manages external traffic entering the mesh. It controls how traffic from outside the cluster is directed into the mesh and routed to the appropriate services.

  • Sidecar: This resource configures the behavior of the sidecar proxies deployed alongside the microservices. It allows for fine-grained control over traffic management and resource usage.

Security

  • mTLS (Mutual TLS): Istio supports mTLS to secure service-to-service communication. mTLS ensures that the identity of both the client and the server is authenticated and that the communication between them is encrypted.

  • Authorization Policies: These policies define access control rules, determining which services or users can access specific resources. Policies can be applied globally, per namespace, or per workload.

  • Ingress/Egress Control: Istio manages both inbound and outbound traffic to ensure that it complies with security policies. Ingress controls how external traffic enters the mesh, while egress manages how traffic leaves the mesh.

Observability

  • Telemetry: Istio collects telemetry data such as metrics, logs, and traces, providing deep insights into the behavior of your microservices. This data is essential for monitoring and debugging applications.

  • Prometheus: Istio integrates with Prometheus, a monitoring system that scrapes metrics from the Envoy proxies. These metrics can be visualized using tools like Grafana.

  • Grafana: A visualization tool used to create dashboards that display the metrics collected by Prometheus. Istio provides pre-built Grafana dashboards to monitor your service mesh.

  • Jaeger/Zipkin: Distributed tracing tools integrated with Istio. They allow you to trace the path of a request as it travels through various services in the mesh, helping to identify performance bottlenecks and errors.

Advanced Concepts

  • Canary Deployments: Istio enables canary deployments by allowing you to gradually roll out a new version of a service to a small percentage of users while monitoring its performance before fully deploying it.

  • Traffic Mirroring: This feature allows you to mirror a portion of live traffic to a new service version without impacting production traffic. It’s useful for testing new versions in a real-world environment.

  • Circuit Breaking: Prevents services from being overwhelmed by limiting the number of concurrent connections or requests. If the limit is reached, Istio can return an error or route traffic to a backup service.

  • Rate Limiting: Controls the rate at which requests are sent to a service, preventing overloads. Rate limits can be defined based on various factors, such as user identity or source IP.

  • Ingress/Egress Policies: These policies control what traffic is allowed to enter or leave the service mesh, enhancing security by restricting access based on predefined rules.

  • Service Entries: Extend the mesh to services outside of the mesh, allowing them to be treated as if they were inside the mesh. This is useful for managing and securing external services.

Example Use Case

Consider a microservices architecture where you need to manage traffic between different versions of a service. With Istio, you can:

  1. Deploy a New Version: Use a VirtualService to route 10% of traffic to a new version of your service.
  2. Monitor the New Version: Collect telemetry data to ensure the new version behaves as expected.
  3. Gradually Increase Traffic: If the new version is stable, gradually increase the traffic percentage.
  4. Roll Back if Needed: If issues are detected, quickly route all traffic back to the previous version using Istio’s traffic management capabilities.