Istio Architecture Overview

Istio Architecture Overview An architecture diagram generated by Archify. Kubernetes API server · Configuration source · Architecture component Kubernetes API server Configuration source Istiod · Pilot · Citadel · Galley · Architecture component Istiod Pilot · Citadel · Galley Ingress Gateway · Envoy proxy · Data plane Ingress Gateway Envoy proxy Application pod A · Envoy sidecar · Data plane Application pod A Envoy sidecar Application pod B · Envoy sidecar · Data plane Application pod B Envoy sidecar Egress Gateway · Controls egress · Data plane Egress Gateway Controls egress watches resources xDS pushes xDS config inbound routing mTLS service traffic Outbound Data plane Legend Frontend Backend Cloud

Control plane (Istiod)

  • • It watches Services and Istio resources on the Kubernetes API server
  • • Pilot translates routing configuration into xDS and pushes it to every Envoy
  • • Citadel issues workload certificates and rotates them automatically

Data plane (Envoy)

  • • A sidecar per pod intercepts all inbound and outbound traffic
  • • Service-to-service traffic is encrypted with mTLS by default
  • • The Ingress Gateway is the entry point; the Egress Gateway is where outbound traffic is controlled

Configuration flow

  • • VirtualService and DestinationRule changes propagate through Istiod as xDS
  • • Configuration lands without restarting the proxy, which is the sidecar model's advantage
  • • istioctl proxy-status shows each proxy's configuration sync state