Skip to main content
⚡ Calmops
🤖 AI 🏗️ Architecture 🌐 Web 🗃️ Database ⚙️ DevOps 🌍 Network 💻 Programming 🧮 Algorithms 📐 Software Eng. ☁️ Cloud 🔒 Security 📈 Finance More →

Service Mesh: Istio and Linkerd

Created: January 1, 0001 2 min read

Service Mesh: Istio and Linkerd

Introduction

Service meshes manage microservice communication. This guide covers Istio and Linkerd for traffic management, security, and observability.

Core Concepts

Service Mesh Benefits

  • Traffic Management: Routing and load balancing
  • Security: mTLS and authorization policies
  • Observability: Metrics, traces, and logs
  • Resilience: Retries and circuit breaking

Good: Istio Setup

Installation

# ✅ GOOD: Install Istio
curl -L https://istio.io/downloadIstio | sh -
cd istio-*
export PATH=$PWD/bin:$PATH
istioctl install --set profile=demo -y

Virtual Service

# ✅ GOOD: Istio VirtualService
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: go-app
spec:
  hosts:
  - go-app
  http:
  - match:
    - uri:
        prefix: "/api"
    route:
    - destination:
        host: go-app
        port:
          number: 8080
        subset: v1
      weight: 80
    - destination:
        host: go-app
        port:
          number: 8080
        subset: v2
      weight: 20

Destination Rule

# ✅ GOOD: Istio DestinationRule
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: go-app
spec:
  host: go-app
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

Good: Linkerd Setup

Installation

# ✅ GOOD: Install Linkerd
curl https://run.linkerd.io/install | sh
export PATH=$PATH:$HOME/.linkerd2/bin
linkerd install | kubectl apply -f -

Inject Sidecar

# ✅ GOOD: Inject Linkerd sidecar
kubectl annotate namespace default linkerd.io/inject=enabled
kubectl rollout restart deployment/go-app

Good: Traffic Management

Retry Policy

# ✅ GOOD: Retry policy
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: go-app
spec:
  hosts:
  - go-app
  http:
  - retries:
      attempts: 3
      perTryTimeout: 2s
    route:
    - destination:
        host: go-app

Circuit Breaker

# ✅ GOOD: Circuit breaker
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: go-app
spec:
  host: go-app
  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s

Good: Security

Authorization Policy

# ✅ GOOD: Authorization policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: go-app
spec:
  selector:
    matchLabels:
      app: go-app
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/frontend"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/api/*"]

Best Practices

1. Start Simple

# ✅ GOOD: Start with basic setup
# Install service mesh
# Inject sidecars
# Monitor metrics

# ❌ BAD: Complex configuration immediately

2. Monitor Metrics

# ✅ GOOD: Monitor service mesh metrics
# Request rate
# Error rate
# Latency
# Traffic distribution

3. Use mTLS

# ✅ GOOD: Enable mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT

Resources

Summary

Service meshes provide powerful capabilities for microservice communication. Start with basic traffic management, gradually add security policies, and leverage observability features. Proper service mesh configuration ensures reliable, secure microservice architectures.

Comments