Istio Architecture: Control Plane and Data Plane

Istio Architecture: Control Plane and Data Plane An architecture diagram generated by Archify. Pilot · service discovery · routing rules · Control Plane (istiod) Pilot service discovery · routing rules Citadel · certificate issuance · mTLS · Control Plane (istiod) Citadel certificate issuance · mTLS Galley · config validation · distribution · Control Plane (istiod) Galley config validation · distribution Envoy Proxy · sidecar · Data Plane › Pod 1 Envoy Proxy sidecar Application · Pod 1 · Data Plane › Pod 1 Application Pod 1 Envoy Proxy · sidecar · Data Plane › Pod 2 Envoy Proxy sidecar Application · Pod 2 · Data Plane › Pod 2 Application Pod 2 Envoy Proxy · sidecar · Data Plane › Pod 3 Envoy Proxy sidecar Application · Pod 3 · Data Plane › Pod 3 Application Pod 3 push config · all Envoys issue certs · all Envoys mTLS mTLS request request request Control Plane (istiod) Data Plane Pod 1 Pod 2 Pod 3 Legend Frontend Backend Security

Control Plane (istiod)

  • • Pilot: service discovery, traffic routing rule management
  • • Citadel: certificate generation and management, mTLS enablement
  • • Galley: configuration validation and distribution

Data Plane

  • • Envoy Proxy: deployed as a sidecar in each pod, intercepting and controlling all network traffic