Istio
Last Updated: September 11, 2026 · Istio 1.31 guidance
This overview keeps the earlier chapter URL usable. The maintained Istio documentation index and installation guide own the detailed procedures and compatibility matrix; use them for current setup.
Table of Contents
Introduction
Istio is an open-source service mesh platform for microservices applications. A service mesh is an infrastructure layer that handles service-to-service communication, allowing infrastructure-level control and observation of service communication. Application trace-context propagation, graceful shutdown and business idempotency still require application participation.
What is a Service Mesh?
A service mesh provides the following core capabilities:
- Traffic Management: Control traffic flow between services
- Security: Encryption and authentication of service-to-service communication
- Observability: Visibility into service-to-service communication
Key Benefits of Istio
- Platform Independence: Works in various environments (Kubernetes, VM, etc.)
- Transparent Integration: Many network controls can be added without changing application business logic
- Workload mTLS: Managed identity and transport protection on enrolled mesh paths; verify enforcement and exceptions
- Advanced Traffic Management: Routing, load balancing, fault injection, etc.
- Detailed Metrics: Detailed metrics on service-to-service communication
- Policy Enforcement: Access control and explicitly configured local/global rate limiting
Key Features
1. Traffic Management
Istio provides powerful traffic management capabilities:
- Gateways: Route external traffic; distinguish Istio Gateway resources from Kubernetes Gateway API
- VirtualService / HTTPRoute: Configure routing using the API supported by the selected data plane and controller
- DestinationRule: Configure load balancing and connection pools
- Traffic Splitting: Support for Canary deployments and A/B testing
- Argo Rollouts Integration: Progressive delivery with separately configured analysis and failure handling
2. Security
Comprehensive security features:
- mTLS: Identity authentication and encryption for enrolled workload transport
- Authorization Policy: Fine-grained access control
- Request Authentication: JWT validation; use AuthorizationPolicy when a JWT must be present
- Peer Authentication: Inbound workload mTLS policy
3. Observability
Telemetry and backend integrations, configured for the selected mode:
- Metrics: Prometheus integration
- Distributed Tracing: Configured trace provider/backend, such as OpenTelemetry with Jaeger; applications propagate context
- Logging: Access logs and structured logging
- Visualization: Kiali dashboard
4. Resilience
Service resilience patterns:
- Circuit Breaker: Connection/request-pool limits; not a guarantee against overload
- Retry: Explicit budgets for retry-safe operations; disable ambiguous write retries
- Timeout: Request timeout configuration
- Outlier Detection: Exclude unhealthy instances
- Rate Limiting: Configured local token buckets or a global rate-limit service
Architecture Overview
Istio consists of a Control Plane and a Data Plane. The following diagram shows the sidecar form, not the ambient topology.
Control Plane (istiod)
istiod is the central control component of Istio, providing:
- Service Discovery: Maintains the mesh's service registry
- Configuration Management: Watches configuration, translates it and distributes proxy settings; Kubernetes persists the API resources
- Certificate Management: Manages workload certificate requests and rotation with the configured CA
Data Plane: Sidecar and Ambient
In sidecar mode, Envoy runs alongside each enrolled application Pod:
- Traffic Routing: Controls traffic between services
- Load Balancing: Distributes traffic across service instances
- Security: mTLS encryption and authentication
- Observability: Collects metrics, logs, and traces
Ambient uses node-level ztunnel for L4 transport and optional Envoy waypoints for supported L7 features. It does not inject an Envoy into every application Pod. Feature support, policy attachment and resource usage differ by mode; neither a fixed resource-saving percentage nor universal performance superiority follows from this topology. See Ambient Mode.
Detailed Documentation
The links below are a learning map into the maintained subtree. Its index includes additional and newly added topics.
📚 Basic Documentation
| Document | Description |
|---|---|
| Installation Guide | Istio installation and initial setup |
| Core Concepts | Basic concepts and terminology of Istio |
| Components | Istio architecture and components |
🚦 Traffic Management
| Document | Description |
|---|---|
| Gateway & VirtualService | Ingress/Egress Gateway configuration |
| Routing | VirtualService routing rules |
| DestinationRule | Service traffic policies |
| Traffic Splitting | Canary deployment and A/B testing |
| Timeout and Retry | Timeout and retry policies |
| Load Balancing | Various load balancing strategies |
| Circuit Breaker | Circuit breaker pattern implementation |
| Fault Injection | Chaos engineering |
| Traffic Mirroring | Traffic mirroring and shadow testing |
| Session Affinity | Session affinity configuration |
🔐 Security
| Document | Description |
|---|---|
| mTLS | Service-to-service mTLS configuration |
| Authorization Policy | Access control policies |
| Request Authentication | JWT-based authentication |
| Peer Authentication | Service-to-service authentication |
📊 Observability
| Document | Description |
|---|---|
| Metrics | Prometheus metrics collection |
| Distributed Tracing | Jaeger/Zipkin integration |
| Logging | Access logs and structured logging |
| Visualization | Kiali, Grafana dashboards |
💪 Resilience
| Document | Description |
|---|---|
| Outlier Detection | Unhealthy instance detection |
| Rate Limiting | Local and global rate limiting |
| Zone Aware Routing | Locality-aware routing |
🚀 Advanced Topics
| Document | Description |
|---|---|
| Ambient Mode | Sidecar-less service mesh |
| Multi-cluster | Multi-cluster mesh configuration |
| EnvoyFilter | Envoy customization |
| DNS Capture and Caching | DNS capture, resolution and measured cache behavior |
| gRPC | gRPC protocol support |
| WebSocket | WebSocket connection support |
| Sidecar Injection | Sidecar injection mechanism |
| Argo Rollouts | Progressive Delivery integration |
✅ Best Practices
| Document | Description |
|---|---|
| Best Practices | Production checklist and recommendations |
Quick Start
- Check the exact Istio/Kubernetes/EKS compatibility intersection in the installation guide. A generic “Kubernetes 1.28+” prerequisite is not sufficient for a current Istio release.
- Choose sidecar or ambient and follow that guide's pinned CLI/chart, isolated namespace and platform prerequisites. Do not download an unspecified latest CLI and then change into an old version directory.
- Use the matching-version Bookinfo procedure and gateway instructions in the maintained guide. The default profile does not automatically provide an ingress gateway Deployment, and a Gateway configuration object alone does not create every installation's required gateway/LoadBalancer.
- Verify the actual gateway address, Service port, route status and HTTP response. A load balancer may publish an IP or hostname; do not assume an AWS-only hostname field or a particular port name.
- Install/configure the chosen observability backends before using dashboard commands. Prometheus, Grafana, Kiali and tracing storage are not automatically installed by the default Istio profile.
Basic verification after completing that procedure:
istioctl version
istioctl analyze -A
istioctl proxy-statusProxy status is only one diagnostic input. Ambient enrollment and ztunnel need their own checks, and a clean analyzer result is not an end-to-end traffic test.
Learning Resources
Official Documentation
AWS and Community
- Istio on Amazon EKS
- Maintained AWS integration guide
- AWS App Mesh lifecycle notice: AWS states support ends September 30, 2026. Evaluate migration requirements; this is not a new-deployment recommendation.
- Istio community, channels and working groups
Additional Resources
Quiz
To test your understanding of Istio, try the Istio Quiz.
The quiz covers the following topics:
- Service mesh basic concepts
- Istio architecture
- Traffic management (Canary deployment)
- Security (mTLS)
- Gateway and Ingress
- Observability tools
- Sidecar and ambient modes
- Rate Limiting
- Locality routing
- Amazon EKS integration
Next Steps: Refer to the Installation Guide to install Istio, and learn basic concepts in Core Concepts.