Istiod Internal Structure

Istiod Internal Structure An architecture diagram generated by Archify. Kubernetes API · API Server + Istio CRDs · Architecture component Kubernetes API API Server + Istio CRDs Citadel functions · CA · Identity (SPIFFE) · Istiod · single process Citadel functions CA · Identity (SPIFFE) Galley functions · Config validation · processing · Istiod · single process Galley functions Config validation · processing Pilot functions · Service Discovery · xDS · Istiod · single process Pilot functions Service Discovery · xDS Envoy Proxies · Sidecars 1..N · Architecture component Envoy Proxies Sidecars 1..N Config validation request validated validated X.509 · SDS API xDS API · config push Istiod · single process Legend Frontend Backend Security External

Istiod single binary

  • • Since Istio 1.5, Pilot, Citadel, and Galley are internal functions of Istiod (pilot-discovery), not separate components
  • • Pilot/Citadel/Galley are historical names used to describe functionality

Delivery to the Data Plane

  • • Pilot functions: convert Istio CRDs to Envoy config and push over the xDS API
  • • Citadel functions: verify the SPIFFE identity, then issue X.509 certificates