istio

Install Istio (demo profile) Install Istio with the demo configuration profile istioctl install --set profile=demo -y #istio#service-mesh#install Enable sidecar injection Enable automatic Envoy sidecar injection for a namespace kubectl label namespace default istio-injection=enabled #istio#service-mesh#sidecar Check proxy status Get sync status of all Envoy proxies in the mesh istioctl proxy-status #istio#service-mesh#proxy Analyze config Analyze Istio configuration for potential issues istioctl analyze #istio#service-mesh#analyze#debug View Envoy config Show complete Envoy proxy config for a deployment istioctl proxy-config all deploy/myapp #istio#service-mesh#envoy#debug Traffic routing — VirtualService Apply a VirtualService to define traffic routing rules kubectl apply -f virtualservice.yaml #istio#service-mesh#virtualservice#routing Traffic routing — DestinationRule Apply a DestinationRule to define load balancing and circuit breaker policies kubectl apply -f destinationrule.yaml #istio#service-mesh#destinationrule Enable mTLS (strict) Enforce strict mutual TLS for all workloads in namespace kubectl apply -f - <<EOF apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default namespace: default spec: mtls: mode: STRICT EOF #istio#service-mesh#mtls#security Inject sidecar manually Manually inject Istio sidecar into a deployment manifest istioctl kube-inject -f deployment.yaml | kubectl apply -f - #istio#service-mesh#sidecar#inject Dashboard (Kiali) Open Kiali service mesh dashboard in browser istioctl dashboard kiali #istio#service-mesh#kiali#dashboard Dashboard (Jaeger) Open Jaeger distributed tracing dashboard istioctl dashboard jaeger #istio#service-mesh#jaeger#tracing View access logs View Envoy access logs from the sidecar container kubectl logs -l app=myapp -c istio-proxy | head -50 #istio#service-mesh#logs#envoy Fault injection — delay Inject artificial delay to test resilience (in VirtualService) # In VirtualService spec.http[].fault.delay #istio#service-mesh#fault-injection#testing Traffic mirroring Mirror traffic to a shadow service for testing # In VirtualService spec.http[].mirror #istio#service-mesh#mirroring#canary Uninstall Istio Completely remove Istio from the cluster istioctl uninstall --purge -y #istio#service-mesh#uninstall Traffic routing — VirtualService Route 80% traffic to v1, 20% to v2 (canary split) kubectl apply -f - <<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: myapp spec: hosts: - myapp http: - route: - destination: host: myapp subset: v1 weight: 80 - destination: host: myapp subset: v2 weight: 20 EOF #istio#service-mesh#virtualservice#routing Traffic routing — DestinationRule Define subsets and circuit breaker (outlier detection) kubectl apply -f - <<EOF apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: myapp spec: host: myapp trafficPolicy: outlierDetection: consecutive5xxErrors: 5 interval: 10s baseEjectionTime: 30s subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2 EOF #istio#service-mesh#destinationrule Fault injection — delay Inject 5s delay for 100% of requests to test resilience kubectl apply -f - <<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: myapp spec: hosts: - myapp http: - fault: delay: percentage: value: 100 fixedDelay: 5s route: - destination: host: myapp EOF #istio#service-mesh#fault-injection#testing Traffic mirroring Mirror 100% of traffic to v2 shadow service kubectl apply -f - <<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: myapp spec: hosts: - myapp http: - route: - destination: host: myapp subset: v1 weight: 100 mirror: host: myapp subset: v2 mirrorPercentage: value: 100 EOF #istio#service-mesh#mirroring#canary