Matt Turner explains the low-level mechanics of how Istio routes traffic using iptables rules and Envoy sidecar proxies.
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Istio - The Packet's-Eye View - Matt Turner, Tetrate
The Istio project reached 1.0 this summer, and is mature enough to have LTS releases. It's getting a lot of attention, but in a lot of ways it's still a mystery. You've probably read about it, you might have tried it, but do you really understand it? It promises advances routing, security, and resiliency, all for free! In this session I'll present a practical introduction to the operation of Istio - what features it can bring to your environment. What's unique about this talk is that we'll be exploring the different parts of Istio by following one plucky little packet into the mesh, through it, and out again. As we meet each component we'll learn why it's there, what it does, and see a demo of how to configure it for common tasks. This will leave you not only with slides showing example configs, but a valuable mental model and a unique insight into the service mesh's operation.
To learn more: sched.co/GraU
Why it's here
2 people recommend this
What people say. Recommended as one of the best, clearest explanations of how Istio works under the hood.
G
u/GTB3NWin r/kubernetes • Recommends
On “ELI5: What is Istio?”
The way I describe it:
- Glorified proxy; iptables rules are injected before a container spawns, as well as a proxy sidecar, the traffic all gets routed through the proxy
- Adds layer 7 (application) logic in a defined way to your cluster, for example: "Allow port 443 outbound but only if the SNI headers are for paypal.com, for everything else alert"
Here's a quick dive in which is the best source I've found. It's fairly condensed in there so the 30 minutes is jam packed - link to this video
No problem! I'm by no means an Istio expert, there are some *amazing* talks out there though which are worth watching, Packet eye view through Istio is one of the best I've seen which really gets down to how everything works together.
If your team has time to sit in a conference room for ~30 minutes and debate whether to use istio or not or have someone explain it, it might be faster to just show snippets of talks, or have a watch-session.
