Istio Detailed Architecture

Istio Detailed Architecture An architecture diagram generated by Archify. Traffic management CRDs · VirtualService · DestinationRule · Gateway · Configuration (Kubernetes CRD) Traffic management CRDs VirtualService · DestinationRule · Gateway Security CRDs · PeerAuthentication · AuthorizationPolicy · Configuration (Kubernetes CRD) Security CRDs PeerAuthentication · AuthorizationPolicy Istiod · Unified control plane (Pilot + Citadel + Galley) · Control Plane Istiod Unified control plane (Pilot + Citadel + Galley) Application · Business logic · Data Plane › Pod 1 Application Business logic Envoy Proxy · Sidecar · Data Plane › Pod 1 Envoy Proxy Sidecar Application · Business logic · Data Plane › Pod 2 Application Business logic Envoy Proxy · Sidecar · Data Plane › Pod 2 Envoy Proxy Sidecar watch CRDs xDS config xDS config mTLS Configuration (Kubernetes CRD) Control Plane Data Plane Pod 1 Pod 2 Legend Application Istiod Istio CRD Envoy proxy

Istiod

  • • Pilot, Citadel and Galley merged into one control plane
  • • Configured through Kubernetes CRDs (VirtualService, DestinationRule, etc.)

Envoy data plane

  • • The C++ Envoy proxy is injected as a sidecar
  • • Traffic between Envoys is automatically encrypted with mTLS