Istio Service Mesh
By the Istio Authors (CNCF)
Istio is an open-source service mesh that transparently layers traffic management, security, and observability onto microservices running on Kubernetes and other platforms, typically using Envoy sidecar proxies.
Definition
Istio is an open-source service mesh that transparently layers traffic management, security, and observability onto microservices running on Kubernetes and other platforms, typically using Envoy sidecar proxies.
Overview
Istio separates the concerns of running a network of services — the data plane — from the concerns of configuring and observing that network — the control plane. In the data plane, an Envoy proxy is injected as a sidecar alongside each application container, intercepting all inbound and outbound traffic. The control plane, `istiod`, configures those proxies with routing rules, mutual TLS certificates, and policy, so application code never needs to implement retries, load balancing, or encryption itself. This architecture unlocks capabilities that are painful to build into every service individually: fine-grained traffic splitting for canary releases and A/B tests, automatic mutual TLS between services for zero-trust security, circuit breaking and fault injection for resilience testing, and rich telemetry — latency, error rates, and request volume — for every service-to-service call, visualized through tools like Kiali and Grafana. Istio's `VirtualService` and `DestinationRule` custom resources give operators a declarative, Kubernetes-native way to express complex routing behavior. Istio originated as a joint project from Google, IBM, and Lyft and is now a CNCF graduated project widely regarded as the most feature-rich service mesh, though that power comes with real operational complexity and resource overhead. Lighter alternatives like Linkerd trade some features for simplicity and a smaller footprint, while Consul and AWS App Mesh target multi-platform or cloud-native scenarios respectively. SkillVeris's Kubernetes course covers the fundamentals that Istio builds on.
Key Features
- Envoy sidecar proxies handling all service-to-service traffic transparently
- Automatic mutual TLS encryption between services with no code changes
- Fine-grained traffic splitting for canary releases and A/B testing
- Circuit breaking, retries, and fault injection for resilience testing
- Rich per-request telemetry integrated with Prometheus, Grafana, and Kiali
- Declarative traffic policy via VirtualService and DestinationRule CRDs
- Fine-grained authorization policy independent of application code
- Multi-cluster and multi-mesh federation for large deployments