mirror of https://github.com/istio/istio.io.git
552 lines
100 KiB
HTML
552 lines
100 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=x-ua-compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content="#466BB0"><meta name=title content="Traffic Management"><meta name=description content="Describes the various Istio features focused on traffic routing and control."><meta name=keywords content="microservices,services,mesh,traffic-management,pilot,envoy-proxies,service-discovery,load-balancing"><meta property="og:title" content="Traffic Management"><meta property="og:type" content="website"><meta property="og:description" content="Describes the various Istio features focused on traffic routing and control."><meta property="og:url" content="/v1.8/docs/concepts/traffic-management/"><meta property="og:image" content="/v1.8/img/istio-whitelogo-bluebackground-framed.svg"><meta property="og:image:alt" content="Istio Logo"><meta property="og:image:width" content="112"><meta property="og:image:height" content="150"><meta property="og:site_name" content="Istio"><meta name=twitter:card content="summary"><meta name=twitter:site content="@IstioMesh"><title>Istioldie 1.8 / Traffic Management</title><script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}
|
||
gtag('js',new Date());gtag('config','UA-98480406-2');</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.8/blog/feed.xml><link rel=alternate type=application/rss+xml title="Istio News" href=/v1.8/news/feed.xml><link rel=alternate type=application/rss+xml title="Istio Blog and News" href=/v1.8/feed.xml><link rel="shortcut icon" href=/v1.8/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.8/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.8/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.8/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.8/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.8/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.8/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.8/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.8/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.8/favicons/android-192x192.png sizes=192x192><link rel=manifest href=/v1.8/manifest.json><meta name=apple-mobile-web-app-title content="Istio"><meta name=application-name content="Istio"><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Work+Sans:400|Chivo:400|Work+Sans:500,300,600,300italic,400italic,500italic,600italic|Chivo:500,300,600,300italic,400italic,500italic,600italic"><link rel=stylesheet href=/v1.8/css/all.css><script src=/v1.8/js/themes_init.min.js></script></head><body class="language-unknown archive-site"><script>const branchName="release-1.8";const docTitle="Traffic Management";const iconFile="\/v1.8/img/icons.svg";const buttonCopy='Copy to clipboard';const buttonPrint='Print';const buttonDownload='Download';</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script><script src=/v1.8/js/all.min.js data-manual defer></script><header><nav><a id=brand href=/v1.8/><span class=logo><svg viewBox="0 0 300 300"><circle cx="150" cy="150" r="146" stroke-width="2"/><polygon points="65 240 225 240 125 270"/><polygon points="65 230 125 220 125 110"/><polygon points="135 220 225 230 135 30"/></svg></span><span class=name>Istioldie 1.8</span></a><div id=hamburger><svg class="icon hamburger"><use xlink:href="/v1.8/img/icons.svg#hamburger"/></svg></div><div id=header-links><a class=current title="Learn how to deploy, use, and operate Istio." href=/v1.8/docs/>Docs</a>
|
||
<a title="Posts about using Istio." href=/v1.8/blog/2020/>Blog<i class=dot data-prefix=/blog></i></a>
|
||
<a title="Timely news about the Istio project." href=/v1.8/news/>News<i class=dot data-prefix=/news></i></a>
|
||
<a title="Frequently Asked Questions about Istio." href=/v1.8/faq/>FAQ</a>
|
||
<a title="Get a bit more in-depth info about the Istio project." href=/v1.8/about/>About</a><div class=menu><button id=gearDropdownButton class=menu-trigger title="Options and settings" aria-label="Options and Settings" aria-controls=gearDropdownContent><svg class="icon gear"><use xlink:href="/v1.8/img/icons.svg#gear"/></svg></button><div id=gearDropdownContent class=menu-content aria-labelledby=gearDropdownButton role=menu><a tabindex=-1 role=menuitem lang=en id=switch-lang-en class=active>English</a>
|
||
<a tabindex=-1 role=menuitem lang=zh id=switch-lang-zh>中文</a><div role=separator></div><a tabindex=-1 role=menuitem class=active id=light-theme-item>Light Theme</a>
|
||
<a tabindex=-1 role=menuitem id=dark-theme-item>Dark Theme</a><div role=separator></div><a tabindex=-1 role=menuitem id=syntax-coloring-item>Color Examples</a><div role=separator></div><h6>Other versions of this site</h6><a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://istio.io/docs\/concepts\/traffic-management\/');return false;">Current Release</a>
|
||
<a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://preliminary.istio.io/docs\/concepts\/traffic-management\/');return false;">Next Release</a>
|
||
<a tabindex=-1 role=menuitem href=https://istio.io/archive>Older Releases</a></div></div><button id=search-show title="Search this site" aria-label=Search><svg class="icon magnifier"><use xlink:href="/v1.8/img/icons.svg#magnifier"/></svg></button></div><form id=search-form name=cse role=search><input type=hidden name=cx value=002184991200833970123:iwwf17ikgf4>
|
||
<input type=hidden name=ie value=utf-8>
|
||
<input type=hidden name=hl value=en>
|
||
<input type=hidden id=search-page-url value=/v1.8/search>
|
||
<input id=search-textbox class=form-control name=q type=search aria-label="Search this site">
|
||
<button id=search-close title="Cancel search" type=reset aria-label="Cancel search"><svg class="icon cancel-x"><use xlink:href="/v1.8/img/icons.svg#cancel-x"/></svg></button></form></nav></header><div class=banner-container></div><main class=primary><div id=sidebar-container class="sidebar-container sidebar-offcanvas"><nav id=sidebar aria-label="Section Navigation"><div class=directory><div class=card><button class="header dynamic" id=card17 title="Learn about the different parts of the Istio system and the abstractions it uses." aria-controls=card17-body><svg class="icon concepts"><use xlink:href="/v1.8/img/icons.svg#concepts"/></svg>Concepts</button><div class="body default" aria-labelledby=card17 role=region id=card17-body><ul role=tree aria-expanded=true class=leaf-section aria-labelledby=card17><li role=none><a role=treeitem title="Introduces Istio, the problems it solves, its high-level architecture, and its design goals." href=/v1.8/docs/concepts/what-is-istio/>What is Istio?</a></li><li role=none><span role=treeitem class=current title="Describes the various Istio features focused on traffic routing and control.">Traffic Management</span></li><li role=none><a role=treeitem title="Describes Istio's authorization and authentication functionality." href=/v1.8/docs/concepts/security/>Security</a></li><li role=none><a role=treeitem title="Describes the telemetry and monitoring features provided by Istio." href=/v1.8/docs/concepts/observability/>Observability</a></li><li role=none><a role=treeitem title="Describes Istio's WebAssembly Plugin system." href=/v1.8/docs/concepts/wasm/>Extensibility</a></li></ul></div></div><div class=card><button class="header dynamic" id=card40 title="Instructions for installing the Istio control plane on Kubernetes." aria-controls=card40-body><svg class="icon setup"><use xlink:href="/v1.8/img/icons.svg#setup"/></svg>Setup</button><div class=body aria-labelledby=card40 role=region id=card40-body><ul role=tree aria-expanded=true aria-labelledby=card40><li role=none><a role=treeitem title="Try Istio’s features quickly and easily." href=/v1.8/docs/setup/getting-started/>Getting Started</a></li><li role=treeitem aria-label="Platform Setup"><button aria-hidden=true></button><a title="How to prepare various Kubernetes platforms before installing Istio." href=/v1.8/docs/setup/platform-setup/>Platform Setup</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Instructions to setup an Alibaba Cloud Kubernetes cluster for Istio." href=/v1.8/docs/setup/platform-setup/alicloud/>Alibaba Cloud</a></li><li role=none><a role=treeitem title="Instructions to setup an Azure cluster for Istio." href=/v1.8/docs/setup/platform-setup/azure/>Azure</a></li><li role=none><a role=treeitem title="Instructions to setup Docker Desktop for Istio." href=/v1.8/docs/setup/platform-setup/docker/>Docker Desktop</a></li><li role=none><a role=treeitem title="Instructions to setup a Google Kubernetes Engine cluster for Istio." href=/v1.8/docs/setup/platform-setup/gke/>Google Kubernetes Engine</a></li><li role=none><a role=treeitem title="Instructions to setup an IBM Cloud cluster for Istio." href=/v1.8/docs/setup/platform-setup/ibm/>IBM Cloud</a></li><li role=none><a role=treeitem title="Instructions to setup kind for Istio." href=/v1.8/docs/setup/platform-setup/kind/>kind</a></li><li role=none><a role=treeitem title="Instructions to setup Kops for use with Istio." href=/v1.8/docs/setup/platform-setup/kops/>Kops</a></li><li role=none><a role=treeitem title="Instructions to setup a Gardener cluster for Istio." href=/v1.8/docs/setup/platform-setup/gardener/>Kubernetes Gardener</a></li><li role=none><a role=treeitem title="Instructions to setup a KubeSphere Container Platform for Istio." href=/v1.8/docs/setup/platform-setup/kubesphere/>KubeSphere Container Platform</a></li><li role=none><a role=treeitem title="Instructions to setup MicroK8s for use with Istio." href=/v1.8/docs/setup/platform-setup/microk8s/>MicroK8s</a></li><li role=none><a role=treeitem title="Instructions to setup minikube for Istio." href=/v1.8/docs/setup/platform-setup/minikube/>Minikube</a></li><li role=none><a role=treeitem title="Instructions to setup an OpenShift cluster for Istio." href=/v1.8/docs/setup/platform-setup/openshift/>OpenShift</a></li><li role=none><a role=treeitem title="Instructions to setup an OKE cluster for Istio." href=/v1.8/docs/setup/platform-setup/oci/>Oracle Cloud Infrastructure</a></li></ul></li><li role=treeitem aria-label=Install><button aria-hidden=true></button><a title="Choose the guide that best suits your needs and platform." href=/v1.8/docs/setup/install/>Install</a><ul role=group aria-expanded=false><li role=none><a role=treeitem title="Install and customize any Istio configuration profile for in-depth evaluation or production use." href=/v1.8/docs/setup/install/istioctl/>Install with Istioctl</a></li><li role=none><a role=treeitem title="Instructions to install Istio in a Kubernetes cluster using the Istio operator." href=/v1.8/docs/setup/install/operator/>Istio Operator Install</a></li><li role=none><a role=treeitem title="Install and configure Istio for in-depth evaluation." href=/v1.8/docs/setup/install/helm/>Install with Helm</a></li><li role=treeitem aria-label="Install Multicluster"><button aria-hidden=true></button><a title="Install an Istio mesh across multiple Kubernetes clusters." href=/v1.8/docs/setup/install/multicluster/>Install Multicluster</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Initial steps before installing Istio on multiple clusters." href=/v1.8/docs/setup/install/multicluster/before-you-begin/>Before you begin</a></li><li role=none><a role=treeitem title="Install an Istio mesh across multiple primary clusters." href=/v1.8/docs/setup/install/multicluster/multi-primary/>Install Multi-Primary</a></li><li role=none><a role=treeitem title="Install an Istio mesh across primary and remote clusters." href=/v1.8/docs/setup/install/multicluster/primary-remote/>Install Primary-Remote</a></li><li role=none><a role=treeitem title="Install an Istio mesh across multiple primary clusters on different networks." href=/v1.8/docs/setup/install/multicluster/multi-primary_multi-network/>Install Multi-Primary on different networks</a></li><li role=none><a role=treeitem title="Install an Istio mesh across primary and remote clusters on different networks." href=/v1.8/docs/setup/install/multicluster/primary-remote_multi-network/>Install Primary-Remote on different networks</a></li><li role=none><a role=treeitem title="Verify that Istio has been installed properly on multiple clusters." href=/v1.8/docs/setup/install/multicluster/verify/>Verify the installation</a></li></ul></li><li role=none><a role=treeitem title="Deploy Istio and connect a workload running within a virtual machine to it." href=/v1.8/docs/setup/install/virtual-machine/>Virtual Machine Installation</a></li></ul></li><li role=treeitem aria-label=Upgrade><button aria-hidden=true></button><a title="Upgrade, downgrade, and manage Istio accross multiple control plane revisions." href=/v1.8/docs/setup/upgrade/>Upgrade</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Upgrade Istio by first running a canary deployment of a new control plane." href=/v1.8/docs/setup/upgrade/canary/>Canary Upgrades</a></li><li role=none><a role=treeitem title="Upgrade or downgrade Istio in place." href=/v1.8/docs/setup/upgrade/in-place/>In-place Upgrades</a></li><li role=none><a role=treeitem title="Configuring and upgrading Istio with gateways." href=/v1.8/docs/setup/upgrade/gateways/>Managing Gateways with Multiple Revisions [experimental]</a></li></ul></li><li role=treeitem aria-label="More Guides"><button aria-hidden=true></button><a title="More information on additional setup tasks." href=/v1.8/docs/setup/additional-setup/>More Guides</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Describes the built-in Istio installation configuration profiles." href=/v1.8/docs/setup/additional-setup/config-profiles/>Installation Configuration Profiles</a></li><li role=none><a role=treeitem title="Install the Istio sidecar in application pods automatically using the sidecar injector webhook or manually using istioctl CLI." href=/v1.8/docs/setup/additional-setup/sidecar-injection/>Installing the Sidecar</a></li><li role=none><a role=treeitem title="Install and use Istio with the Istio CNI plugin, allowing operators to deploy services with lower privilege." href=/v1.8/docs/setup/additional-setup/cni/>Install Istio with the Istio CNI plugin</a></li><li role=none><a role=treeitem title="Install an external control plane and remote cluster." href=/v1.8/docs/setup/additional-setup/external-controlplane/>Install Istio with an External Control Plane</a></li></ul></li></ul></div></div><div class=card><button class="header dynamic" id=card73 title="How to do single specific targeted activities with the Istio system." aria-controls=card73-body><svg class="icon tasks"><use xlink:href="/v1.8/img/icons.svg#tasks"/></svg>Tasks</button><div class=body aria-labelledby=card73 role=region id=card73-body><ul role=tree aria-expanded=true aria-labelledby=card73><li role=treeitem aria-label="Traffic Management"><button aria-hidden=true></button><a title="Tasks that demonstrate Istio's traffic routing features." href=/v1.8/docs/tasks/traffic-management/>Traffic Management</a><ul role=group aria-expanded=false><li role=none><a role=treeitem title="This task shows you how to configure dynamic request routing to multiple versions of a microservice." href=/v1.8/docs/tasks/traffic-management/request-routing/>Request Routing</a></li><li role=none><a role=treeitem title="This task shows you how to inject faults to test the resiliency of your application." href=/v1.8/docs/tasks/traffic-management/fault-injection/>Fault Injection</a></li><li role=none><a role=treeitem title="Shows you how to migrate traffic from an old to new version of a service." href=/v1.8/docs/tasks/traffic-management/traffic-shifting/>Traffic Shifting</a></li><li role=none><a role=treeitem title="Shows you how to migrate TCP traffic from an old to new version of a TCP service." href=/v1.8/docs/tasks/traffic-management/tcp-traffic-shifting/>TCP Traffic Shifting</a></li><li role=none><a role=treeitem title="This task shows you how to setup request timeouts in Envoy using Istio." href=/v1.8/docs/tasks/traffic-management/request-timeouts/>Request Timeouts</a></li><li role=none><a role=treeitem title="This task shows you how to configure circuit breaking for connections, requests, and outlier detection." href=/v1.8/docs/tasks/traffic-management/circuit-breaking/>Circuit Breaking</a></li><li role=none><a role=treeitem title="This task demonstrates the traffic mirroring/shadowing capabilities of Istio." href=/v1.8/docs/tasks/traffic-management/mirroring/>Mirroring</a></li><li role=treeitem aria-label=Ingress><button aria-hidden=true></button><a title="Controlling ingress traffic for an Istio service mesh." href=/v1.8/docs/tasks/traffic-management/ingress/>Ingress</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Describes how to configure an Istio gateway to expose a service outside of the service mesh." href=/v1.8/docs/tasks/traffic-management/ingress/ingress-control/>Ingress Gateways</a></li><li role=none><a role=treeitem title="Expose a service outside of the service mesh over TLS or mTLS." href=/v1.8/docs/tasks/traffic-management/ingress/secure-ingress/>Secure Gateways</a></li><li role=none><a role=treeitem title="Describes how to configure SNI passthrough for an ingress gateway." href=/v1.8/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/>Ingress Gateway without TLS Termination</a></li><li role=none><a role=treeitem title="Describes how to configure a Kubernetes Ingress object to expose a service outside of the service mesh." href=/v1.8/docs/tasks/traffic-management/ingress/kubernetes-ingress/>Kubernetes Ingress</a></li><li role=none><a role=treeitem title="Describes how to configure the Kubernetes Service APIs with Istio." href=/v1.8/docs/tasks/traffic-management/ingress/service-apis/>Kubernetes Service APIs [Experimental]</a></li></ul></li><li role=treeitem aria-label=Egress><button aria-hidden=true></button><a title="Controlling egress traffic for an Istio service mesh." href=/v1.8/docs/tasks/traffic-management/egress/>Egress</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Describes how to configure Istio to route traffic from services in the mesh to external services." href=/v1.8/docs/tasks/traffic-management/egress/egress-control/>Accessing External Services</a></li><li role=none><a role=treeitem title="Describes how to configure Istio to perform TLS origination for traffic to external services." href=/v1.8/docs/tasks/traffic-management/egress/egress-tls-origination/>Egress TLS Origination</a></li><li role=none><a role=treeitem title="Describes how to configure Istio to direct traffic to external services through a dedicated gateway." href=/v1.8/docs/tasks/traffic-management/egress/egress-gateway/>Egress Gateways</a></li><li role=none><a role=treeitem title="Describes how to configure an Egress Gateway to perform TLS origination to external services using Secret Discovery Service." href=/v1.8/docs/tasks/traffic-management/egress/egress-gateway-tls-origination-sds/>Egress Gateways with TLS Origination (SDS)</a></li><li role=none><a role=treeitem title="Describes how to configure an Egress Gateway to perform TLS origination to external services using file mount certificates." href=/v1.8/docs/tasks/traffic-management/egress/egress-gateway-tls-origination/>Egress Gateways with TLS Origination (File Mount)</a></li><li role=none><a role=treeitem title="Describes how to enable egress traffic for a set of hosts in a common domain, instead of configuring each and every host separately." href=/v1.8/docs/tasks/traffic-management/egress/wildcard-egress-hosts/>Egress using Wildcard Hosts</a></li><li role=none><a role=treeitem title="Shows how to configure Istio for Kubernetes External Services." href=/v1.8/docs/tasks/traffic-management/egress/egress-kubernetes-services/>Kubernetes Services for Egress Traffic</a></li><li role=none><a role=treeitem title="Describes how to configure Istio to let applications use an external HTTPS proxy." href=/v1.8/docs/tasks/traffic-management/egress/http-proxy/>Using an External HTTPS Proxy</a></li></ul></li></ul></li><li role=treeitem aria-label=Security><button aria-hidden=true></button><a title="Demonstrates how to secure the mesh." href=/v1.8/docs/tasks/security/>Security</a><ul role=group aria-expanded=false><li role=treeitem aria-label="Certificate Management"><button aria-hidden=true></button><a title="Management of the certificates in Istio." href=/v1.8/docs/tasks/security/cert-management/>Certificate Management</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Shows how system administrators can configure Istio's CA with a root certificate, signing certificate and key." href=/v1.8/docs/tasks/security/cert-management/plugin-ca-cert/>Plug in CA Certificates</a></li><li role=none><a role=treeitem title="Shows how to provision and manage DNS certificates in Istio." href=/v1.8/docs/tasks/security/cert-management/dns-cert/>Istio DNS Certificate Management</a></li><li role=none><a role=treeitem title="Shows how to use a Custom Certificate Authority (that integrates with the Kubernetes CSR API) to provision Istio workload certificates." href=/v1.8/docs/tasks/security/cert-management/custom-ca-k8s/>Custom CA Integration using Kubernetes CSR [experimental]</a></li></ul></li><li role=treeitem aria-label=Authentication><button aria-hidden=true></button><a title="Controlling mutual TLS and end-user authentication for mesh services." href=/v1.8/docs/tasks/security/authentication/>Authentication</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Shows you how to use Istio authentication policy to setup mutual TLS and basic end-user authentication." href=/v1.8/docs/tasks/security/authentication/authn-policy/>Authentication Policy</a></li><li role=none><a role=treeitem title="Shows you how to incrementally migrate your Istio services to mutual TLS." href=/v1.8/docs/tasks/security/authentication/mtls-migration/>Mutual TLS Migration</a></li></ul></li><li role=treeitem aria-label=Authorization><button aria-hidden=true></button><a title="Shows how to control access to Istio services." href=/v1.8/docs/tasks/security/authorization/>Authorization</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Shows how to set up access control for HTTP traffic." href=/v1.8/docs/tasks/security/authorization/authz-http/>Authorization for HTTP traffic</a></li><li role=none><a role=treeitem title="How to set up access control for TCP traffic." href=/v1.8/docs/tasks/security/authorization/authz-tcp/>Authorization for TCP traffic</a></li><li role=none><a role=treeitem title="How to set up access control with JWT in Istio." href=/v1.8/docs/tasks/security/authorization/authz-jwt/>Authorization with JWT</a></li><li role=none><a role=treeitem title="Shows how to set up access control to deny traffic explicitly." href=/v1.8/docs/tasks/security/authorization/authz-deny/>Authorization policies with a deny action</a></li><li role=none><a role=treeitem title="How to set up access control on an ingress gateway." href=/v1.8/docs/tasks/security/authorization/authz-ingress/>Authorization on Ingress Gateway</a></li><li role=none><a role=treeitem title="Shows how to migrate from one trust domain to another without changing authorization policy." href=/v1.8/docs/tasks/security/authorization/authz-td-migration/>Authorization Policy Trust Domain Migration</a></li></ul></li></ul></li><li role=treeitem aria-label=Observability><button aria-hidden=true></button><a title="Demonstrates how to collect telemetry information from the mesh." href=/v1.8/docs/tasks/observability/>Observability</a><ul role=group aria-expanded=false><li role=treeitem aria-label=Metrics><button aria-hidden=true></button><a title="Demonstrates the collection and querying of metrics within Istio." href=/v1.8/docs/tasks/observability/metrics/>Metrics</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="This task shows you how to configure Istio to collect metrics for TCP services." href=/v1.8/docs/tasks/observability/metrics/tcp-metrics/>Collecting Metrics for TCP Services</a></li><li role=none><a role=treeitem title="This task shows you how to customize the Istio metrics." href=/v1.8/docs/tasks/observability/metrics/customize-metrics/>Customizing Istio Metrics</a></li><li role=none><a role=treeitem title="This task shows you how to improve telemetry by grouping requests and responses by their type." href=/v1.8/docs/tasks/observability/metrics/classify-metrics/>Classifying Metrics Based on Request or Response (Experimental)</a></li><li role=none><a role=treeitem title="This task shows you how to query for Istio Metrics using Prometheus." href=/v1.8/docs/tasks/observability/metrics/querying-metrics/>Querying Metrics from Prometheus</a></li><li role=none><a role=treeitem title="This task shows you how to setup and use the Istio Dashboard to monitor mesh traffic." href=/v1.8/docs/tasks/observability/metrics/using-istio-dashboard/>Visualizing Metrics with Grafana</a></li></ul></li><li role=treeitem aria-label=Logs><button aria-hidden=true></button><a title="Demonstrates the collection of logs within Istio." href=/v1.8/docs/tasks/observability/logs/>Logs</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="This task shows you how to configure Envoy proxies to print access logs to their standard output." href=/v1.8/docs/tasks/observability/logs/access-log/>Getting Envoy's Access Logs</a></li></ul></li><li role=treeitem aria-label="Distributed Tracing"><button aria-hidden=true></button><a title="This task shows you how to configure Istio-enabled applications to collect trace spans." href=/v1.8/docs/tasks/observability/distributed-tracing/>Distributed Tracing</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Overview of distributed tracing in Istio." href=/v1.8/docs/tasks/observability/distributed-tracing/overview/>Overview</a></li><li role=none><a role=treeitem title="Learn how to configure the proxies to send tracing requests to Zipkin." href=/v1.8/docs/tasks/observability/distributed-tracing/zipkin/>Zipkin</a></li><li role=none><a role=treeitem title="Learn how to configure the proxies to send tracing requests to Jaeger." href=/v1.8/docs/tasks/observability/distributed-tracing/jaeger/>Jaeger</a></li><li role=none><a role=treeitem title="How to configure the proxies to send tracing requests to Lightstep." href=/v1.8/docs/tasks/observability/distributed-tracing/lightstep/>Lightstep</a></li><li role=none><a role=treeitem title="How to configure tracing options (beta/development)." href=/v1.8/docs/tasks/observability/distributed-tracing/configurability/>Configurability (Beta/Development)</a></li></ul></li><li role=none><a role=treeitem title="This task shows you how to visualize your services within an Istio mesh." href=/v1.8/docs/tasks/observability/kiali/>Visualizing Your Mesh</a></li><li role=none><a role=treeitem title="This task shows you how to configure external access to the set of Istio telemetry addons." href=/v1.8/docs/tasks/observability/gateways/>Remotely Accessing Telemetry Addons</a></li></ul></li></ul></div></div><div class=card><button class="header dynamic" id=card94 title="A variety of fully working example uses for Istio that you can experiment with." aria-controls=card94-body><svg class="icon examples"><use xlink:href="/v1.8/img/icons.svg#examples"/></svg>Examples</button><div class=body aria-labelledby=card94 role=region id=card94-body><ul role=tree aria-expanded=true aria-labelledby=card94><li role=none><a role=treeitem title="Deploys a sample application composed of four separate microservices used to demonstrate various Istio features." href=/v1.8/docs/examples/bookinfo/>Bookinfo Application</a></li><li role=treeitem aria-label="Virtual Machines"><button aria-hidden=true></button><a title="Examples that add workloads running on virtual machines to an Istio mesh." href=/v1.8/docs/examples/virtual-machines/>Virtual Machines</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Learn how to add a service running on a virtual machine to your single-network Istio mesh." href=/v1.8/docs/examples/virtual-machines/single-network/>Example Application using Virtual Machines in a Single Network Mesh</a></li><li role=none><a role=treeitem title="Learn how to add a service running on a virtual machine to your multi-network Istio mesh." href=/v1.8/docs/examples/virtual-machines/multi-network/>Virtual Machines in Multi-Network Meshes</a></li><li role=none><a role=treeitem title="Run the Bookinfo application with a MySQL service running on a virtual machine within your mesh." href=/v1.8/docs/examples/virtual-machines/bookinfo/>Bookinfo with a Virtual Machine</a></li></ul></li><li role=treeitem aria-label="Learn Microservices using Kubernetes and Istio"><button aria-hidden=true></button><a title="This modular tutorial provides new users with hands-on experience using Istio for common microservices scenarios, one step at a time." href=/v1.8/docs/examples/microservices-istio/>Learn Microservices using Kubernetes and Istio</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/prereq/>Prerequisites</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/setup-kubernetes-cluster/>Setup a Kubernetes Cluster</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/setup-local-computer/>Setup a Local Computer</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/single/>Run a Microservice Locally</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/package-service/>Run ratings in Docker</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/bookinfo-kubernetes/>Run Bookinfo with Kubernetes</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/production-testing/>Test in production</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/add-new-microservice-version/>Add a new version of reviews</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/add-istio/>Enable Istio on productpage</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/enable-istio-all-microservices/>Enable Istio on all the microservices</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/istio-ingress-gateway/>Configure Istio Ingress Gateway</a></li><li role=none><a role=treeitem href=/v1.8/docs/examples/microservices-istio/logs-istio/>Monitoring with Istio</a></li></ul></li></ul></div></div><div class=card><button class="header dynamic" id=card118 title="Concepts, tools, and techniques to deploy and manage an Istio mesh." aria-controls=card118-body><svg class="icon guide"><use xlink:href="/v1.8/img/icons.svg#guide"/></svg>Operations</button><div class=body aria-labelledby=card118 role=region id=card118-body><ul role=tree aria-expanded=true aria-labelledby=card118><li role=treeitem aria-label=Deployment><button aria-hidden=true></button><a title="Requirements, concepts, and considerations for setting up an Istio deployment." href=/v1.8/docs/ops/deployment/>Deployment</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Describes Istio's high-level architecture and design goals." href=/v1.8/docs/ops/deployment/architecture/>Architecture</a></li><li role=none><a role=treeitem title="Describes the options and considerations when configuring your Istio deployment." href=/v1.8/docs/ops/deployment/deployment-models/>Deployment Models</a></li><li role=none><a role=treeitem title="Istio performance and scalability summary." href=/v1.8/docs/ops/deployment/performance-and-scalability/>Performance and Scalability</a></li><li role=none><a role=treeitem title="Requirements of applications deployed in an Istio-enabled cluster." href=/v1.8/docs/ops/deployment/requirements/>Application Requirements</a></li></ul></li><li role=treeitem aria-label=Configuration><button aria-hidden=true></button><a title="Advanced concepts and features for configuring a running Istio mesh." href=/v1.8/docs/ops/configuration/>Configuration</a><ul role=group aria-expanded=false><li role=treeitem aria-label="Mesh Configuration"><button aria-hidden=true></button><a title="Helps you manage the global mesh configuration." href=/v1.8/docs/ops/configuration/mesh/>Mesh Configuration</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Provides a general overview of Istio's use of Kubernetes webhooks and the related issues that can arise." href=/v1.8/docs/ops/configuration/mesh/webhook/>Dynamic Admission Webhooks Overview</a></li><li role=none><a role=treeitem title="Describes how to wait to apply mesh configuration until a resource reaches a given status or readiness." href=/v1.8/docs/ops/configuration/mesh/config-resource-ready/>Wait for Resource Status to Apply Configuration</a></li><li role=none><a role=treeitem title="Describes Istio's use of Kubernetes webhooks for automatic sidecar injection." href=/v1.8/docs/ops/configuration/mesh/injection-concepts/>Automatic Sidecar Injection</a></li><li role=none><a role=treeitem title="Shows how to do health checking for Istio services." href=/v1.8/docs/ops/configuration/mesh/app-health-check/>Health Checking of Istio Services</a></li></ul></li><li role=treeitem aria-label="Traffic Management"><button aria-hidden=true></button><a title="Helps you manage the networking aspects of a running mesh." href=/v1.8/docs/ops/configuration/traffic-management/>Traffic Management</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Information on how to specify protocols." href=/v1.8/docs/ops/configuration/traffic-management/protocol-selection/>Protocol Selection</a></li><li role=none><a role=treeitem title="Information on how to enable and understand Locality Load Balancing." href=/v1.8/docs/ops/configuration/traffic-management/locality-load-balancing/>Locality Load Balancing</a></li><li role=none><a role=treeitem title="How to configure TLS settings to secure network traffic." href=/v1.8/docs/ops/configuration/traffic-management/tls-configuration/>TLS Configuration</a></li><li role=none><a role=treeitem title="How to configure gateway network topology." href=/v1.8/docs/ops/configuration/traffic-management/network-topologies/>Configuring Gateway Network Topology [experimental]</a></li></ul></li><li role=treeitem aria-label=Security><button aria-hidden=true></button><a title="Helps you manage the security aspects of a running mesh." href=/v1.8/docs/ops/configuration/security/>Security</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Use hardened container images to reduce Istio's attack surface." href=/v1.8/docs/ops/configuration/security/harden-docker-images/>Harden Docker Container Images</a></li><li role=none><a role=treeitem title="Learn how to extend the lifetime of the Istio self-signed root certificate." href=/v1.8/docs/ops/configuration/security/root-transition/>Extending Self-Signed Certificate Lifetime</a></li></ul></li><li role=treeitem aria-label=Observability><button aria-hidden=true></button><a title="Helps you manage telemetry collection and visualization in a running mesh." href=/v1.8/docs/ops/configuration/telemetry/>Observability</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Fine-grained control of Envoy statistics." href=/v1.8/docs/ops/configuration/telemetry/envoy-stats/>Envoy Statistics</a></li><li role=none><a role=treeitem title="Configure Prometheus to monitor multicluster Istio." href=/v1.8/docs/ops/configuration/telemetry/monitoring-multicluster-prometheus/>Monitoring Multicluster Istio with Prometheus</a></li></ul></li></ul></li><li role=treeitem aria-label="Best Practices"><button aria-hidden=true></button><a title="Best practices for setting up and managing an Istio service mesh." href=/v1.8/docs/ops/best-practices/>Best Practices</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="General best practices when setting up an Istio service mesh." href=/v1.8/docs/ops/best-practices/deployment/>Deployment Best Practices</a></li><li role=none><a role=treeitem title="Configuration best practices to avoid networking or traffic management issues." href=/v1.8/docs/ops/best-practices/traffic-management/>Traffic Management Best Practices</a></li><li role=none><a role=treeitem title="Best practices for securing applications using Istio." href=/v1.8/docs/ops/best-practices/security/>Security Best Practices</a></li><li role=none><a role=treeitem title="Best practices for observing applications using Istio." href=/v1.8/docs/ops/best-practices/observability/>Observability Best Practices</a></li></ul></li><li role=treeitem aria-label="Common Problems"><button aria-hidden=true></button><a title="Describes how to identify and resolve common problems in Istio." href=/v1.8/docs/ops/common-problems/>Common Problems</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Techniques to address common Istio traffic management and network problems." href=/v1.8/docs/ops/common-problems/network-issues/>Traffic Management Problems</a></li><li role=none><a role=treeitem title="Techniques to address common Istio authentication, authorization, and general security-related problems." href=/v1.8/docs/ops/common-problems/security-issues/>Security Problems</a></li><li role=none><a role=treeitem title="Dealing with telemetry collection issues." href=/v1.8/docs/ops/common-problems/observability-issues/>Observability Problems</a></li><li role=none><a role=treeitem title="Resolve common problems with Istio's use of Kubernetes webhooks for automatic sidecar injection." href=/v1.8/docs/ops/common-problems/injection/>Sidecar Injection Problems</a></li><li role=none><a role=treeitem title="Describes how to resolve configuration validation problems." href=/v1.8/docs/ops/common-problems/validation/>Configuration Validation Problems</a></li></ul></li><li role=treeitem aria-label="Diagnostic Tools"><button aria-hidden=true></button><a title="Tools and techniques to help troubleshoot an Istio mesh." href=/v1.8/docs/ops/diagnostic-tools/>Diagnostic Tools</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Istio includes a supplemental tool that provides debugging and diagnosis for Istio service mesh deployments." href=/v1.8/docs/ops/diagnostic-tools/istioctl/>Using the Istioctl Command-line Tool</a></li><li role=none><a role=treeitem title="Describes tools and techniques to diagnose Envoy configuration issues related to traffic management." href=/v1.8/docs/ops/diagnostic-tools/proxy-cmd/>Debugging Envoy and Istiod</a></li><li role=none><a role=treeitem title="Shows you how to use istioctl describe to verify the configurations of a pod in your mesh." href=/v1.8/docs/ops/diagnostic-tools/istioctl-describe/>Understand your Mesh with Istioctl Describe</a></li><li role=none><a role=treeitem title="Shows you how to use istioctl analyze to identify potential issues with your configuration." href=/v1.8/docs/ops/diagnostic-tools/istioctl-analyze/>Diagnose your Configuration with Istioctl Analyze</a></li><li role=none><a role=treeitem title="Describes how to use ControlZ to get insight into a running istiod component." href=/v1.8/docs/ops/diagnostic-tools/controlz/>Istiod Introspection</a></li><li role=none><a role=treeitem title="Describes how to use component-level logging to get insights into a running component's behavior." href=/v1.8/docs/ops/diagnostic-tools/component-logging/>Component Logging</a></li></ul></li><li role=treeitem aria-label=Integrations><button aria-hidden=true></button><a title="Other softwares that Istio can integrate with to provide additional functionality." href=/v1.8/docs/ops/integrations/>Integrations</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Information on how to integrate with cert-manager." href=/v1.8/docs/ops/integrations/certmanager/>cert-manager</a></li><li role=none><a role=treeitem title="Information on how to integrate with Grafana to set up Istio dashboards." href=/v1.8/docs/ops/integrations/grafana/>Grafana</a></li><li role=none><a role=treeitem title="How to integrate with Jaeger." href=/v1.8/docs/ops/integrations/jaeger/>Jaeger</a></li><li role=none><a role=treeitem title="Information on how to integrate with Kiali." href=/v1.8/docs/ops/integrations/kiali/>Kiali</a></li><li role=none><a role=treeitem title="How to integrate with Prometheus." href=/v1.8/docs/ops/integrations/prometheus/>Prometheus</a></li><li role=none><a role=treeitem title="How to integrate with Zipkin." href=/v1.8/docs/ops/integrations/zipkin/>Zipkin</a></li></ul></li></ul></div></div><div class=card><button class="header dynamic" id=card169 title="Detailed authoritative reference material such as command-line options, configuration options, and API calling parameters." aria-controls=card169-body><svg class="icon reference"><use xlink:href="/v1.8/img/icons.svg#reference"/></svg>Reference</button><div class=body aria-labelledby=card169 role=region id=card169-body><ul role=tree aria-expanded=true aria-labelledby=card169><li role=treeitem aria-label=Configuration><button aria-hidden=true></button><a title="Detailed information on configuration options." href=/v1.8/docs/reference/config/>Configuration</a><ul role=group aria-expanded=false><li role=none><a role=treeitem title="Configuration affecting Istio control plane installation version and shape." href=/v1.8/docs/reference/config/istio.operator.v1alpha1/>IstioOperator Options</a></li><li role=none><a role=treeitem title="Configuration affecting the service mesh as a whole." href=/v1.8/docs/reference/config/istio.mesh.v1alpha1/>Global Mesh Options</a></li><li role=none><a role=treeitem title="Describes the structure of messages generated by Istio analyzers." href=/v1.8/docs/reference/config/istio.analysis.v1alpha1/>Analysis Messages</a></li><li role=none><a role=treeitem title="Describes the role of the `status` field in configuration workflow." href=/v1.8/docs/reference/config/config-status/>Configuration Status Field</a></li><li role=treeitem aria-label="Proxy Extensions"><button aria-hidden=true></button><a title="Describes how to configure Istio proxy extensions." href=/v1.8/docs/reference/config/proxy_extensions/>Proxy Extensions</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Configuration for Metadata Exchange Filter." href=/v1.8/docs/reference/config/proxy_extensions/metadata_exchange/>Metadata Exchange Config</a></li><li role=none><a role=treeitem title="Configuration for Stackdriver filter." href=/v1.8/docs/reference/config/proxy_extensions/stackdriver/>Stackdriver Config</a></li><li role=none><a role=treeitem title="Configuration for Attribute Generation plugin." href=/v1.8/docs/reference/config/proxy_extensions/attributegen/>AttributeGen Config</a></li><li role=none><a role=treeitem title="Configuration for AccessLogPolicy Filter." href=/v1.8/docs/reference/config/proxy_extensions/accesslogpolicy/>AccessLogPolicy Config</a></li><li role=none><a role=treeitem title="Configuration for Stats Filter." href=/v1.8/docs/reference/config/proxy_extensions/stats/>Stats Config</a></li><li role=none><a role=treeitem title="How to enable telemetry generation with the Wasm runtime (experimental)." href=/v1.8/docs/reference/config/proxy_extensions/wasm_telemetry/>Wasm-based Telemetry (Experimental)</a></li></ul></li><li role=treeitem aria-label="Traffic Management"><button aria-hidden=true></button><a title="Describes how to configure HTTP/TCP routing features." href=/v1.8/docs/reference/config/networking/>Traffic Management</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Configuration affecting load balancing, outlier detection, etc." href=/v1.8/docs/reference/config/networking/destination-rule/>Destination Rule</a></li><li role=none><a role=treeitem title="Customizing Envoy configuration generated by Istio." href=/v1.8/docs/reference/config/networking/envoy-filter/>Envoy Filter</a></li><li role=none><a role=treeitem title="Configuration affecting edge load balancer." href=/v1.8/docs/reference/config/networking/gateway/>Gateway</a></li><li role=none><a role=treeitem title="Configuration affecting service registry." href=/v1.8/docs/reference/config/networking/service-entry/>Service Entry</a></li><li role=none><a role=treeitem title="Configuration affecting network reachability of a sidecar." href=/v1.8/docs/reference/config/networking/sidecar/>Sidecar</a></li><li role=none><a role=treeitem title="Describes a collection of workload instances." href=/v1.8/docs/reference/config/networking/workload-group/>Workload Group</a></li><li role=none><a role=treeitem title="Configuration affecting VMs onboarded into the mesh." href=/v1.8/docs/reference/config/networking/workload-entry/>Workload Entry</a></li><li role=none><a role=treeitem title="Configuration affecting label/content routing, sni routing, etc." href=/v1.8/docs/reference/config/networking/virtual-service/>Virtual Service</a></li></ul></li><li role=treeitem aria-label=Security><button aria-hidden=true></button><a title="Describes how to configure Istio's security features." href=/v1.8/docs/reference/config/security/>Security</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Configuration to validate JWT." href=/v1.8/docs/reference/config/security/jwt/>JWTRule</a></li><li role=none><a role=treeitem title="Peer authentication configuration for workloads." href=/v1.8/docs/reference/config/security/peer_authentication/>PeerAuthentication</a></li><li role=none><a role=treeitem title="Request authentication configuration for workloads." href=/v1.8/docs/reference/config/security/request_authentication/>RequestAuthentication</a></li><li role=none><a role=treeitem title="Configuration for access control on workloads." href=/v1.8/docs/reference/config/security/authorization-policy/>Authorization Policy</a></li><li role=none><a role=treeitem title="Describes the supported conditions in authorization policies." href=/v1.8/docs/reference/config/security/conditions/>Authorization Policy Conditions</a></li></ul></li><li role=treeitem aria-label="Common Types"><button aria-hidden=true></button><a title="Describes common types in Istio API." href=/v1.8/docs/reference/config/type/>Common Types</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Definition of a workload selector." href=/v1.8/docs/reference/config/type/workload-selector/>Workload Selector</a></li></ul></li><li role=none><a role=treeitem title="Istio standard metrics exported by Istio telemetry." href=/v1.8/docs/reference/config/metrics/>Istio Standard Metrics</a></li><li role=none><a role=treeitem title="Resource annotations used by Istio." href=/v1.8/docs/reference/config/annotations/>Resource Annotations</a></li><li role=treeitem aria-label="Configuration Analysis Messages"><button aria-hidden=true></button><a title="Documents the individual error and warning messages produced during configuration analysis." href=/v1.8/docs/reference/config/analysis/>Configuration Analysis Messages</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0113/>MTLSPolicyConflict</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0109/>ConflictingMeshGatewayVirtualServiceHosts</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0110/>ConflictingSidecarWorkloadSelectors</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0116/>DeploymentAssociatedToMultipleServices</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0117/>DeploymentRequiresServiceAssociated</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0002/>Deprecated</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0104/>GatewayPortNotOnWorkload</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0001/>InternalError</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0125/>InvalidAnnotation</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0122/>InvalidRegexp</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0105/>IstioProxyImageMismatch</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0119/>JwtFailureDueToInvalidServicePortPrefix</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0107/>MisplacedAnnotation</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0108/>UnknownAnnotation</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0111/>MultipleSidecarsWithoutWorkloadSelectors</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0123/>NamespaceMultipleInjectionLabels</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0102/>NamespaceNotInjected</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0127/>NoMatchingWorkloadsFound</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0128/>NoServerCertificateVerificationDestinationLevel</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0129/>NoServerCertificateVerificationPortLevel</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/message-format/>Analyzer Message Format</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0131/>VirtualServiceIneffectiveMatch</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0118/>PortNameIsNotUnderNamingConvention</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0101/>ReferencedResourceNotFound</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0106/>SchemaValidationError</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0130/>VirtualServiceUnreachableRule</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0103/>PodMissingProxy</a></li><li role=none><a role=treeitem href=/v1.8/docs/reference/config/analysis/ist0112/>VirtualServiceDestinationPortSelectorRequired</a></li></ul></li></ul></li><li role=treeitem aria-label=Commands><button aria-hidden=true></button><a title="Describes usage and options of the Istio commands and utilities." href=/v1.8/docs/reference/commands/>Commands</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Istio control interface." href=/v1.8/docs/reference/commands/istioctl/>istioctl</a></li><li role=none><a role=treeitem title="Istio Pilot." href=/v1.8/docs/reference/commands/pilot-discovery/>pilot-discovery</a></li><li role=none><a role=treeitem title="The Istio operator." href=/v1.8/docs/reference/commands/operator/>operator</a></li><li role=none><a role=treeitem title="Istio Pilot agent." href=/v1.8/docs/reference/commands/pilot-agent/>pilot-agent</a></li></ul></li><li role=none><a role=treeitem title="A glossary of common Istio terms." href=/v1.8/docs/reference/glossary/>Glossary</a></li></ul></div></div></div></nav></div><div class=article-container><button tabindex=-1 id=sidebar-toggler title="Toggle the navigation bar"><svg class="icon pull"><use xlink:href="/v1.8/img/icons.svg#pull"/></svg></button><nav aria-label=Breadcrumb><ol><li><a href=/v1.8/ title="Connect, secure, control, and observe services.">Istio</a></li><li><a href=/v1.8/docs/ title="Learn how to deploy, use, and operate Istio.">Docs</a></li><li><a href=/v1.8/docs/concepts/ title="Learn about the different parts of the Istio system and the abstractions it uses.">Concepts</a></li><li>Traffic Management</li></ol></nav><article aria-labelledby=title><div class=title-area><div style=width:100%><h1 id=title>Traffic Management</h1><p class=byline><span title="4501 words"><svg class="icon clock"><use xlink:href="/v1.8/img/icons.svg#clock"/></svg><span> </span>22 minute read</span>
|
||
<span> </span>
|
||
<span><a href=https://github.com/istio/istio.io/tree/master/README.md#testing-document-content title="No automated test is available for this page. Click for details or to help create one."><svg class="icon cancel-grey"><use xlink:href="/v1.8/img/icons.svg#cancel-grey"/></svg><span> </span>
|
||
page test</a></span></p></div></div><nav class=toc-inlined aria-label="Table of Contents"><div><hr><ol><li role=none aria-label="Introducing Istio traffic management"><a href=#introducing-istio-traffic-management>Introducing Istio traffic management</a><li role=none aria-label="Virtual services"><a href=#virtual-services>Virtual services</a><ol><li role=none aria-label="Why use virtual services?"><a href=#why-use-virtual-services>Why use virtual services?</a><li role=none aria-label="Virtual service example"><a href=#virtual-service-example>Virtual service example</a><ol><li role=none aria-label="The hosts field"><a href=#the-hosts-field>The hosts field</a><li role=none aria-label="Routing rules"><a href=#routing-rules>Routing rules</a><ol><li role=none aria-label="Match condition"><a href=#match-condition>Match condition</a><li role=none aria-label=Destination><a href=#destination>Destination</a></ol></li><li role=none aria-label="Routing rule precedence"><a href=#routing-rule-precedence>Routing rule precedence</a></ol></li><li role=none aria-label="More about routing rules"><a href=#more-about-routing-rules>More about routing rules</a></ol></li><li role=none aria-label="Destination rules"><a href=#destination-rules>Destination rules</a><ol><li role=none aria-label="Load balancing options"><a href=#load-balancing-options>Load balancing options</a><li role=none aria-label="Destination rule example"><a href=#destination-rule-example>Destination rule example</a></ol></li><li role=none aria-label=Gateways><a href=#gateways>Gateways</a><ol><li role=none aria-label="Gateway example"><a href=#gateway-example>Gateway example</a></ol></li><li role=none aria-label="Service entries"><a href=#service-entries>Service entries</a><ol><li role=none aria-label="Service entry example"><a href=#service-entry-example>Service entry example</a></ol></li><li role=none aria-label=Sidecars><a href=#sidecars>Sidecars</a><li role=none aria-label="Network resilience and testing"><a href=#network-resilience-and-testing>Network resilience and testing</a><ol><li role=none aria-label=Timeouts><a href=#timeouts>Timeouts</a><li role=none aria-label=Retries><a href=#retries>Retries</a><li role=none aria-label="Circuit breakers"><a href=#circuit-breakers>Circuit breakers</a><li role=none aria-label="Fault injection"><a href=#fault-injection>Fault injection</a><li role=none aria-label="Working with your applications"><a href=#working-with-your-applications>Working with your applications</a></ol></li><li role=none aria-label="See also"><a href=#see-also>See also</a></li></ol><hr></div></nav><p>Istio’s traffic routing rules let you easily control the flow
|
||
of traffic and API calls between services. Istio simplifies configuration of
|
||
service-level properties like circuit breakers, timeouts, and retries, and makes
|
||
it easy to set up important tasks like A/B testing, canary rollouts, and staged
|
||
rollouts with percentage-based traffic splits. It also provides out-of-box
|
||
failure recovery features that help make your application
|
||
more robust against failures of dependent services or the network.</p><p>Istio’s traffic management model relies on the <span class=term data-title=Envoy data-body='<p>The high-performance proxy that Istio uses to mediate inbound and outbound traffic for all <a href="/docs/reference/glossary/#service">services</a> in the
|
||
<a href="/docs/reference/glossary/#service-mesh">service mesh</a>. <a href="https://envoyproxy.github.io/envoy/">Learn more about Envoy</a>.</p>'>Envoy</span>
|
||
proxies that are deployed along with your services. All traffic that your mesh
|
||
services send and receive (<span class=term data-title="Data Plane" data-body='<p>The data plane is the part of the mesh that directly controls communication between workload instances.
|
||
Istio&rsquo;s data plane uses intelligent <a href="/docs/reference/glossary/#envoy">Envoy</a> proxies deployed as sidecars to mediate and control all
|
||
traffic that your mesh services send and receive.</p>'>data plane</span> traffic) is proxied through Envoy, making
|
||
it easy to direct and control traffic around your mesh without making any
|
||
changes to your services.</p><p>If you’re interested in the details of how the features described in this guide
|
||
work, you can find out more about Istio’s traffic management implementation in the
|
||
<a href=/v1.8/docs/ops/deployment/architecture/>architecture overview</a>. The rest of
|
||
this guide introduces Istio’s traffic management features.</p><h2 id=introducing-istio-traffic-management>Introducing Istio traffic management</h2><p>In order to direct traffic within your mesh, Istio needs to know where all your
|
||
endpoints are, and which services they belong to. To populate its own
|
||
<span class=term data-title="Service Registry" data-body='<p>Istio maintains an internal service registry containing the set of <a href="/docs/reference/glossary/#service">services</a>,
|
||
and their corresponding <a href="/docs/reference/glossary/#service-endpoint">service endpoints</a>, running in a service mesh.
|
||
Istio uses the service registry to generate <a href="/docs/reference/glossary/#envoy">Envoy</a> configuration.</p>
|
||
|
||
<p>Istio does not provide <a href="https://en.wikipedia.org/wiki/Service_discovery">service discovery</a>,
|
||
although most services are automatically added to the registry by <a href="/docs/reference/glossary/#pilot">Pilot</a>
|
||
adapters that reflect the discovered services of the underlying platform (Kubernetes, Consul, plain DNS).
|
||
Additional services can also be registered manually using a
|
||
<a href="/docs/concepts/traffic-management/#service-entries"><code>ServiceEntry</code></a> configuration.</p>'>service registry</span>, Istio connects to a service
|
||
discovery system. For example, if you’ve installed Istio on a Kubernetes cluster,
|
||
then Istio automatically detects the services and endpoints in that cluster.</p><p>Using this service registry, the Envoy proxies can then direct traffic to the
|
||
relevant services. Most microservice-based applications have multiple instances
|
||
of each service workload to handle service traffic, sometimes referred to as a
|
||
load balancing pool. By default, the Envoy proxies distribute traffic across
|
||
each service’s load balancing pool using a round-robin model, where requests are
|
||
sent to each pool member in turn, returning to the top of the pool once each
|
||
service instance has received a request.</p><p>While Istio’s basic service discovery and load balancing gives you a working
|
||
service mesh, it’s far from all that Istio can do. In many cases you might want
|
||
more fine-grained control over what happens to your mesh traffic.
|
||
You might want to direct a particular percentage of traffic to a new version of
|
||
a service as part of A/B testing, or apply a different load balancing policy to
|
||
traffic for a particular subset of service instances. You might also want to
|
||
apply special rules to traffic coming into or out of your mesh, or add an
|
||
external dependency of your mesh to the service registry. You can do all this
|
||
and more by adding your own traffic configuration to Istio using Istio’s traffic
|
||
management API.</p><p>Like other Istio configuration, the API is specified using Kubernetes custom
|
||
resource definitions (<span class=term data-title=CRDs data-body='<p><a href="https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/">Custom resource definitions (CRDs)</a>
|
||
are extensions of the default Kubernetes API. Istio uses the Kubernetes CRD API for
|
||
configuration, even for non-Kubernetes Istio deployments.</p>'>CRDs</span>), which you can configure
|
||
using YAML, as you’ll see in the examples.</p><p>The rest of this guide examines each of the traffic management API resources
|
||
and what you can do with them. These resources are:</p><ul><li><a href=#virtual-services>Virtual services</a></li><li><a href=#destination-rules>Destination rules</a></li><li><a href=#gateways>Gateways</a></li><li><a href=#service-entries>Service entries</a></li><li><a href=#sidecars>Sidecars</a></li></ul><p>This guide also gives an overview of some of the
|
||
<a href=#network-resilience-and-testing>network resilience and testing features</a> that
|
||
are built in to the API resources.</p><h2 id=virtual-services>Virtual services</h2><p><a href=/v1.8/docs/reference/config/networking/virtual-service/#VirtualService>Virtual services</a>,
|
||
along with <a href=#destination-rules>destination rules</a>, are the key building blocks of Istio’s traffic
|
||
routing functionality. A virtual service lets you configure how requests are
|
||
routed to a service within an Istio service mesh, building on the basic
|
||
connectivity and discovery provided by Istio and your platform. Each virtual
|
||
service consists of a set of routing rules that are evaluated in order, letting
|
||
Istio match each given request to the virtual service to a specific real
|
||
destination within the mesh. Your mesh can require multiple virtual services or
|
||
none depending on your use case.</p><h3 id=why-use-virtual-services>Why use virtual services?</h3><p>Virtual services play a key role in making Istio’s traffic management flexible
|
||
and powerful. They do this by strongly decoupling where clients send their
|
||
requests from the destination workloads that actually implement them. Virtual
|
||
services also provide a rich way of specifying different traffic routing rules
|
||
for sending traffic to those workloads.</p><p>Why is this so useful? Without virtual services, Envoy distributes
|
||
traffic using round-robin load balancing between all service instances, as
|
||
described in the introduction. You can improve this behavior with what you know
|
||
about the workloads. For example, some might represent a different version. This
|
||
can be useful in A/B testing, where you might want to configure traffic routes
|
||
based on percentages across different service versions, or to direct
|
||
traffic from your internal users to a particular set of instances.</p><p>With a virtual service, you can specify traffic behavior for one or more hostnames.
|
||
You use routing rules in the virtual service that tell Envoy how to send the
|
||
virtual service’s traffic to appropriate destinations. Route destinations can
|
||
be versions of the same service or entirely different services.</p><p>A typical use case is to send traffic to different versions of a service,
|
||
specified as service subsets. Clients send requests to the virtual service host as if
|
||
it was a single entity, and Envoy then routes the traffic to the different
|
||
versions depending on the virtual service rules: for example, “20% of calls go to
|
||
the new version” or “calls from these users go to version 2”. This allows you to,
|
||
for instance, create a canary rollout where you gradually increase the
|
||
percentage of traffic that’s sent to a new service version. The traffic routing
|
||
is completely separate from the instance deployment, meaning that the number of
|
||
instances implementing the new service version can scale up and down based on
|
||
traffic load without referring to traffic routing at all. By contrast, container
|
||
orchestration platforms like Kubernetes only support traffic distribution based
|
||
on instance scaling, which quickly becomes complex. You can read more about how
|
||
virtual services help with canary deployments in <a href=/v1.8/blog/2017/0.1-canary/>Canary Deployments using Istio</a>.</p><p>Virtual services also let you:</p><ul><li>Address multiple application services through a single virtual service. If
|
||
your mesh uses Kubernetes, for example, you can configure a virtual service
|
||
to handle all services in a specific namespace. Mapping a single
|
||
virtual service to multiple “real” services is particularly useful in
|
||
facilitating turning a monolithic application into a composite service built
|
||
out of distinct microservices without requiring the consumers of the service
|
||
to adapt to the transition. Your routing rules can specify “calls to these URIs of
|
||
<code>monolith.com</code> go to <code>microservice A</code>”, and so on. You can see how this works
|
||
in <a href=#more-about-routing-rules>one of our examples below</a>.</li><li>Configure traffic rules in combination with
|
||
<a href=/v1.8/docs/concepts/traffic-management/#gateways>gateways</a> to control ingress
|
||
and egress traffic.</li></ul><p>In some cases you also need to configure destination rules to use these
|
||
features, as these are where you specify your service subsets. Specifying
|
||
service subsets and other destination-specific policies in a separate object
|
||
lets you reuse these cleanly between virtual services. You can find out more
|
||
about destination rules in the next section.</p><h3 id=virtual-service-example>Virtual service example</h3><p>The following virtual service routes
|
||
requests to different versions of a service depending on whether the request
|
||
comes from a particular user.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: reviews
|
||
spec:
|
||
hosts:
|
||
- reviews
|
||
http:
|
||
- match:
|
||
- headers:
|
||
end-user:
|
||
exact: jason
|
||
route:
|
||
- destination:
|
||
host: reviews
|
||
subset: v2
|
||
- route:
|
||
- destination:
|
||
host: reviews
|
||
subset: v3
|
||
</code></pre><h4 id=the-hosts-field>The hosts field</h4><p>The <code>hosts</code> field lists the virtual service’s hosts - in other words, the user-addressable
|
||
destination or destinations that these routing rules apply to. This is the
|
||
address or addresses the client uses when sending requests to the service.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>hosts:
|
||
- reviews
|
||
</code></pre><p>The virtual service hostname can be an IP address, a DNS name, or, depending on
|
||
the platform, a short name (such as a Kubernetes service short name) that resolves,
|
||
implicitly or explicitly, to a fully qualified domain name (FQDN). You can also
|
||
use wildcard (”*”) prefixes, letting you create a single set of routing rules for
|
||
all matching services. Virtual service hosts don’t actually have to be part of the
|
||
Istio service registry, they are simply virtual destinations. This lets you model
|
||
traffic for virtual hosts that don’t have routable entries inside the mesh.</p><h4 id=routing-rules>Routing rules</h4><p>The <code>http</code> section contains the virtual service’s routing rules, describing
|
||
match conditions and actions for routing HTTP/1.1, HTTP2, and gRPC traffic sent
|
||
to the destination(s) specified in the hosts field (you can also use <code>tcp</code> and
|
||
<code>tls</code> sections to configure routing rules for
|
||
<a href=/v1.8/docs/reference/config/networking/virtual-service/#TCPRoute>TCP</a> and
|
||
unterminated
|
||
<a href=/v1.8/docs/reference/config/networking/virtual-service/#TLSRoute>TLS</a>
|
||
traffic). A routing rule consists of the destination where you want the traffic
|
||
to go and zero or more match conditions, depending on your use case.</p><h5 id=match-condition>Match condition</h5><p>The first routing rule in the example has a condition and so begins with the
|
||
<code>match</code> field. In this case you want this routing to apply to all requests from
|
||
the user “jason”, so you use the <code>headers</code>, <code>end-user</code>, and <code>exact</code> fields to select
|
||
the appropriate requests.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>- match:
|
||
- headers:
|
||
end-user:
|
||
exact: jason
|
||
</code></pre><h5 id=destination>Destination</h5><p>The route section’s <code>destination</code> field specifies the actual destination for
|
||
traffic that matches this condition. Unlike the virtual service’s host(s), the
|
||
destination’s host must be a real destination that exists in Istio’s service
|
||
registry or Envoy won’t know where to send traffic to it. This can be a mesh
|
||
service with proxies or a non-mesh service added using a service entry. In this
|
||
case we’re running on Kubernetes and the host name is a Kubernetes service name:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>route:
|
||
- destination:
|
||
host: reviews
|
||
subset: v2
|
||
</code></pre><p>Note in this and the other examples on this page, we use a Kubernetes short name for the
|
||
destination hosts for simplicity. When this rule is evaluated, Istio adds a domain suffix based
|
||
on the namespace of the virtual service that contains the routing rule to get
|
||
the fully qualified name for the host. Using short names in our examples
|
||
also means that you can copy and try them in any namespace you like.</p><div><aside class="callout warning"><div class=type><svg class="large-icon"><use xlink:href="/v1.8/img/icons.svg#callout-warning"/></svg></div><div class=content>Using short names like this only works if the
|
||
destination hosts and the virtual service are actually in the same Kubernetes
|
||
namespace. Because using the Kubernetes short name can result in
|
||
misconfigurations, we recommend that you specify fully qualified host names in
|
||
production environments.</div></aside></div><p>The destination section also specifies which subset of this Kubernetes service
|
||
you want requests that match this rule’s conditions to go to, in this case the
|
||
subset named v2. You’ll see how you define a service subset in the section on
|
||
<a href=#destination-rules>destination rules</a> below.</p><h4 id=routing-rule-precedence>Routing rule precedence</h4><p>Routing rules are <strong>evaluated in sequential order from top to bottom</strong>, with the
|
||
first rule in the virtual service definition being given highest priority. In
|
||
this case you want anything that doesn’t match the first routing rule to go to a
|
||
default destination, specified in the second rule. Because of this, the second
|
||
rule has no match conditions and just directs traffic to the v3 subset.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>- route:
|
||
- destination:
|
||
host: reviews
|
||
subset: v3
|
||
</code></pre><p>We recommend providing a default “no condition” or weight-based rule (described
|
||
below) like this as the last rule in each virtual service to ensure that traffic
|
||
to the virtual service always has at least one matching route.</p><h3 id=more-about-routing-rules>More about routing rules</h3><p>As you saw above, routing rules are a powerful tool for routing particular
|
||
subsets of traffic to particular destinations. You can set match conditions on
|
||
traffic ports, header fields, URIs, and more. For example, this virtual service
|
||
lets users send traffic to two separate services, ratings and reviews, as if
|
||
they were part of a bigger virtual service at <code>http://bookinfo.com/.</code> The
|
||
virtual service rules match traffic based on request URIs and direct requests to
|
||
the appropriate service.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: bookinfo
|
||
spec:
|
||
hosts:
|
||
- bookinfo.com
|
||
http:
|
||
- match:
|
||
- uri:
|
||
prefix: /reviews
|
||
route:
|
||
- destination:
|
||
host: reviews
|
||
- match:
|
||
- uri:
|
||
prefix: /ratings
|
||
route:
|
||
- destination:
|
||
host: ratings
|
||
</code></pre><p>For some match conditions, you can also choose to select them using the exact
|
||
value, a prefix, or a regex.</p><p>You can add multiple match conditions to the same <code>match</code> block to AND your
|
||
conditions, or add multiple match blocks to the same rule to OR your conditions.
|
||
You can also have multiple routing rules for any given virtual service. This
|
||
lets you make your routing conditions as complex or simple as you like within a
|
||
single virtual service. A full list of match condition fields and their possible
|
||
values can be found in the
|
||
<a href=/v1.8/docs/reference/config/networking/virtual-service/#HTTPMatchRequest><code>HTTPMatchRequest</code> reference</a>.</p><p>In addition to using match conditions, you can distribute traffic
|
||
by percentage “weight”. This is useful for A/B testing and canary rollouts:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>spec:
|
||
hosts:
|
||
- reviews
|
||
http:
|
||
- route:
|
||
- destination:
|
||
host: reviews
|
||
subset: v1
|
||
weight: 75
|
||
- destination:
|
||
host: reviews
|
||
subset: v2
|
||
weight: 25
|
||
</code></pre><p>You can also use routing rules to perform some actions on the traffic, for
|
||
example:</p><ul><li>Append or remove headers.</li><li>Rewrite the URL.</li><li>Set a <a href=#retries>retry policy</a> for calls to this destination.</li></ul><p>To learn more about the actions available, see the
|
||
<a href=/v1.8/docs/reference/config/networking/virtual-service/#HTTPRoute><code>HTTPRoute</code> reference</a>.</p><h2 id=destination-rules>Destination rules</h2><p>Along with <a href=#virtual-services>virtual services</a>,
|
||
<a href=/v1.8/docs/reference/config/networking/destination-rule/#DestinationRule>destination rules</a>
|
||
are a key part of Istio’s traffic routing functionality. You can think of
|
||
virtual services as how you route your traffic <strong>to</strong> a given destination, and
|
||
then you use destination rules to configure what happens to traffic <strong>for</strong> that
|
||
destination. Destination rules are applied after virtual service routing rules
|
||
are evaluated, so they apply to the traffic’s “real” destination.</p><p>In particular, you use destination rules to specify named service subsets, such
|
||
as grouping all a given service’s instances by version. You can then use these
|
||
service subsets in the routing rules of virtual services to control the
|
||
traffic to different instances of your services.</p><p>Destination rules also let you customize Envoy’s traffic policies when calling
|
||
the entire destination service or a particular service subset, such as your
|
||
preferred load balancing model, TLS security mode, or circuit breaker settings.
|
||
You can see a complete list of destination rule options in the
|
||
<a href=/v1.8/docs/reference/config/networking/destination-rule/>Destination Rule reference</a>.</p><h3 id=load-balancing-options>Load balancing options</h3><p>By default, Istio uses a round-robin load balancing policy, where each service
|
||
instance in the instance pool gets a request in turn. Istio also supports the
|
||
following models, which you can specify in destination rules for requests to a
|
||
particular service or service subset.</p><ul><li>Random: Requests are forwarded at random to instances in the pool.</li><li>Weighted: Requests are forwarded to instances in the pool according to a
|
||
specific percentage.</li><li>Least requests: Requests are forwarded to instances with the least number of
|
||
requests.</li></ul><p>See the
|
||
<a href=https://www.envoyproxy.io/docs/envoy/v1.5.0/intro/arch_overview/load_balancing>Envoy load balancing documentation</a>
|
||
for more information about each option.</p><h3 id=destination-rule-example>Destination rule example</h3><p>The following example destination rule configures three different subsets for
|
||
the <code>my-svc</code> destination service, with different load balancing policies:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: DestinationRule
|
||
metadata:
|
||
name: my-destination-rule
|
||
spec:
|
||
host: my-svc
|
||
trafficPolicy:
|
||
loadBalancer:
|
||
simple: RANDOM
|
||
subsets:
|
||
- name: v1
|
||
labels:
|
||
version: v1
|
||
- name: v2
|
||
labels:
|
||
version: v2
|
||
trafficPolicy:
|
||
loadBalancer:
|
||
simple: ROUND_ROBIN
|
||
- name: v3
|
||
labels:
|
||
version: v3
|
||
</code></pre><p>Each subset is defined based on one or more <code>labels</code>, which in Kubernetes are
|
||
key/value pairs that are attached to objects such as Pods. These labels are
|
||
applied in the Kubernetes service’s deployment as <code>metadata</code> to identify
|
||
different versions.</p><p>As well as defining subsets, this destination rule has both a default traffic
|
||
policy for all subsets in this destination and a subset-specific policy that
|
||
overrides it for just that subset. The default policy, defined above the <code>subsets</code>
|
||
field, sets a simple random load balancer for the <code>v1</code> and <code>v3</code> subsets. In the
|
||
<code>v2</code> policy, a round-robin load balancer is specified in the corresponding
|
||
subset’s field.</p><h2 id=gateways>Gateways</h2><p>You use a <a href=/v1.8/docs/reference/config/networking/gateway/#Gateway>gateway</a> to
|
||
manage inbound and outbound traffic for your mesh, letting you specify which
|
||
traffic you want to enter or leave the mesh. Gateway configurations are applied
|
||
to standalone Envoy proxies that are running at the edge of the mesh, rather
|
||
than sidecar Envoy proxies running alongside your service workloads.</p><p>Unlike other mechanisms for controlling traffic entering your systems, such as
|
||
the Kubernetes Ingress APIs, Istio gateways let you use the full power and
|
||
flexibility of Istio’s traffic routing. You can do this because Istio’s Gateway
|
||
resource just lets you configure layer 4-6 load balancing properties such as
|
||
ports to expose, TLS settings, and so on. Then instead of adding
|
||
application-layer traffic routing (L7) to the same API resource, you bind a
|
||
regular Istio <a href=#virtual-services>virtual service</a> to the gateway. This lets you
|
||
basically manage gateway traffic like any other data plane traffic in an Istio
|
||
mesh.</p><p>Gateways are primarily used to manage ingress traffic, but you can also
|
||
configure egress gateways. An egress gateway lets you configure a dedicated exit
|
||
node for the traffic leaving the mesh, letting you limit which services can or
|
||
should access external networks, or to enable
|
||
<a href=/v1.8/blog/2019/egress-traffic-control-in-istio-part-1/>secure control of egress traffic</a>
|
||
to add security to your mesh, for example. You can also use a gateway to
|
||
configure a purely internal proxy.</p><p>Istio provides some preconfigured gateway proxy deployments
|
||
(<code>istio-ingressgateway</code> and <code>istio-egressgateway</code>) that you can use - both are
|
||
deployed if you use our <a href=/v1.8/docs/setup/getting-started/>demo installation</a>,
|
||
while just the ingress gateway is deployed with our
|
||
<a href=/v1.8/docs/setup/additional-setup/config-profiles/>default profile.</a> You
|
||
can apply your own gateway configurations to these deployments or deploy and
|
||
configure your own gateway proxies.</p><h3 id=gateway-example>Gateway example</h3><p>The following example shows a possible gateway configuration for external HTTPS
|
||
ingress traffic:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: Gateway
|
||
metadata:
|
||
name: ext-host-gwy
|
||
spec:
|
||
selector:
|
||
app: my-gateway-controller
|
||
servers:
|
||
- port:
|
||
number: 443
|
||
name: https
|
||
protocol: HTTPS
|
||
hosts:
|
||
- ext-host.example.com
|
||
tls:
|
||
mode: SIMPLE
|
||
credentialName: ext-host-cert
|
||
</code></pre><p>This gateway configuration lets HTTPS traffic from <code>ext-host.example.com</code> into the mesh on
|
||
port 443, but doesn’t specify any routing for the traffic.</p><p>To specify routing and for the gateway to work as intended, you must also bind
|
||
the gateway to a virtual service. You do this using the virtual service’s
|
||
<code>gateways</code> field, as shown in the following example:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: virtual-svc
|
||
spec:
|
||
hosts:
|
||
- ext-host.example.com
|
||
gateways:
|
||
- ext-host-gwy
|
||
</code></pre><p>You can then configure the virtual service with routing rules for the external
|
||
traffic.</p><h2 id=service-entries>Service entries</h2><p>You use a
|
||
<a href=/v1.8/docs/reference/config/networking/service-entry/#ServiceEntry>service entry</a> to add
|
||
an entry to the service registry that Istio maintains internally. After you add
|
||
the service entry, the Envoy proxies can send traffic to the service as if it
|
||
was a service in your mesh. Configuring service entries allows you to manage
|
||
traffic for services running outside of the mesh, including the following tasks:</p><ul><li>Redirect and forward traffic for external destinations, such as APIs
|
||
consumed from the web, or traffic to services in legacy infrastructure.</li><li>Define <a href=#retries>retry</a>, <a href=#timeouts>timeout</a>, and
|
||
<a href=#fault-injection>fault injection</a> policies for external destinations.</li><li>Run a mesh service in a Virtual Machine (VM) by
|
||
<a href=/v1.8/docs/examples/virtual-machines/>adding VMs to your mesh</a>.</li><li>Logically add services from a different cluster to the mesh to configure a
|
||
<a href=/v1.8/docs/setup/install/multicluster>multicluster Istio mesh</a>
|
||
on Kubernetes.</li></ul><p>You don’t need to add a service entry for every external service that you want
|
||
your mesh services to use. By default, Istio configures the Envoy proxies to
|
||
passthrough requests to unknown services. However, you can’t use Istio features
|
||
to control the traffic to destinations that aren’t registered in the mesh.</p><h3 id=service-entry-example>Service entry example</h3><p>The following example mesh-external service entry adds the <code>ext-svc.example.com</code>
|
||
external dependency to Istio’s service registry:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: ServiceEntry
|
||
metadata:
|
||
name: svc-entry
|
||
spec:
|
||
hosts:
|
||
- ext-svc.example.com
|
||
ports:
|
||
- number: 443
|
||
name: https
|
||
protocol: HTTPS
|
||
location: MESH_EXTERNAL
|
||
resolution: DNS
|
||
</code></pre><p>You specify the external resource using the <code>hosts</code> field. You can qualify it
|
||
fully or use a wildcard prefixed domain name.</p><p>You can configure virtual services and destination rules to control traffic to a
|
||
service entry in a more granular way, in the same way you configure traffic for
|
||
any other service in the mesh. For example, the following destination rule
|
||
configures the traffic route to use mutual TLS to secure the connection to the
|
||
<code>ext-svc.example.com</code> external service that we configured using the service entry:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: DestinationRule
|
||
metadata:
|
||
name: ext-res-dr
|
||
spec:
|
||
host: ext-svc.example.com
|
||
trafficPolicy:
|
||
tls:
|
||
mode: MUTUAL
|
||
clientCertificate: /etc/certs/myclientcert.pem
|
||
privateKey: /etc/certs/client_private_key.pem
|
||
caCertificates: /etc/certs/rootcacerts.pem
|
||
</code></pre><p>See the
|
||
<a href=/v1.8/docs/reference/config/networking/service-entry>Service Entry reference</a>
|
||
for more possible configuration options.</p><h2 id=sidecars>Sidecars</h2><p>By default, Istio configures every Envoy proxy to accept traffic on all the
|
||
ports of its associated workload, and to reach every workload in the mesh when
|
||
forwarding traffic. You can use a <a href=/v1.8/docs/reference/config/networking/sidecar/#Sidecar>sidecar</a> configuration to do the following:</p><ul><li>Fine-tune the set of ports and protocols that an Envoy proxy accepts.</li><li>Limit the set of services that the Envoy proxy can reach.</li></ul><p>You might want to limit sidecar reachability like this in larger applications,
|
||
where having every proxy configured to reach every other service in the mesh can
|
||
potentially affect mesh performance due to high memory usage.</p><p>You can specify that you want a sidecar configuration to apply to all workloads
|
||
in a particular namespace, or choose specific workloads using a
|
||
<code>workloadSelector</code>. For example, the following sidecar configuration configures
|
||
all services in the <code>bookinfo</code> namespace to only reach services running in the
|
||
same namespace and the Istio control plane (currently needed to use Istio’s
|
||
policy and telemetry features):</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: Sidecar
|
||
metadata:
|
||
name: default
|
||
namespace: bookinfo
|
||
spec:
|
||
egress:
|
||
- hosts:
|
||
- "./*"
|
||
- "istio-system/*"
|
||
</code></pre><p>See the <a href=/v1.8/docs/reference/config/networking/sidecar/>Sidecar reference</a>
|
||
for more details.</p><h2 id=network-resilience-and-testing>Network resilience and testing</h2><p>As well as helping you direct traffic around your mesh, Istio provides opt-in
|
||
failure recovery and fault injection features that you can configure dynamically
|
||
at runtime. Using these features helps your applications operate reliably,
|
||
ensuring that the service mesh can tolerate failing nodes and preventing
|
||
localized failures from cascading to other nodes.</p><h3 id=timeouts>Timeouts</h3><p>A timeout is the amount of time that an Envoy proxy should wait for replies from
|
||
a given service, ensuring that services don’t hang around waiting for replies
|
||
indefinitely and that calls succeed or fail within a predictable timeframe. The
|
||
Envoy timeout for HTTP requests is disabled in Istio by default.</p><p>For some applications and services, Istio’s default timeout might not be
|
||
appropriate. For example, a timeout that is too long could result in excessive
|
||
latency from waiting for replies from failing services, while a timeout that is
|
||
too short could result in calls failing unnecessarily while waiting for an
|
||
operation involving multiple services to return. To find and use your optimal timeout
|
||
settings, Istio lets you easily adjust timeouts dynamically on a per-service
|
||
basis using <a href=#virtual-services>virtual services</a> without having to edit your
|
||
service code. Here’s a virtual service that specifies a 10 second timeout for
|
||
calls to the v1 subset of the ratings service:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: ratings
|
||
spec:
|
||
hosts:
|
||
- ratings
|
||
http:
|
||
- route:
|
||
- destination:
|
||
host: ratings
|
||
subset: v1
|
||
timeout: 10s
|
||
</code></pre><h3 id=retries>Retries</h3><p>A retry setting specifies the maximum number of times an Envoy proxy attempts to
|
||
connect to a service if the initial call fails. Retries can enhance service
|
||
availability and application performance by making sure that calls don’t fail
|
||
permanently because of transient problems such as a temporarily overloaded
|
||
service or network. The interval between retries (25ms+) is variable and
|
||
determined automatically by Istio, preventing the called service from being
|
||
overwhelmed with requests. The default retry behavior for HTTP requests is to
|
||
retry twice before returning the error.</p><p>Like timeouts, Istio’s default retry behavior might not suit your application
|
||
needs in terms of latency (too many retries to a failed service can slow things
|
||
down) or availability. Also like timeouts, you can adjust your retry settings on
|
||
a per-service basis in <a href=#virtual-services>virtual services</a> without having to
|
||
touch your service code. You can also further refine your retry behavior by
|
||
adding per-retry timeouts, specifying the amount of time you want to wait for
|
||
each retry attempt to successfully connect to the service. The following example
|
||
configures a maximum of 3 retries to connect to this service subset after an
|
||
initial call failure, each with a 2 second timeout.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: ratings
|
||
spec:
|
||
hosts:
|
||
- ratings
|
||
http:
|
||
- route:
|
||
- destination:
|
||
host: ratings
|
||
subset: v1
|
||
retries:
|
||
attempts: 3
|
||
perTryTimeout: 2s
|
||
</code></pre><h3 id=circuit-breakers>Circuit breakers</h3><p>Circuit breakers are another useful mechanism Istio provides for creating
|
||
resilient microservice-based applications. In a circuit breaker, you set limits
|
||
for calls to individual hosts within a service, such as the number of concurrent
|
||
connections or how many times calls to this host have failed. Once that limit
|
||
has been reached the circuit breaker “trips” and stops further connections to
|
||
that host. Using a circuit breaker pattern enables fast failure rather than
|
||
clients trying to connect to an overloaded or failing host.</p><p>As circuit breaking applies to “real” mesh destinations in a load balancing
|
||
pool, you configure circuit breaker thresholds in
|
||
<a href=#destination-rules>destination rules</a>, with the settings applying to each
|
||
individual host in the service. The following example limits the number of
|
||
concurrent connections for the <code>reviews</code> service workloads of the v1 subset to
|
||
100:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: DestinationRule
|
||
metadata:
|
||
name: reviews
|
||
spec:
|
||
host: reviews
|
||
subsets:
|
||
- name: v1
|
||
labels:
|
||
version: v1
|
||
trafficPolicy:
|
||
connectionPool:
|
||
tcp:
|
||
maxConnections: 100
|
||
</code></pre><p>You can find out more about creating circuit breakers in
|
||
<a href=/v1.8/docs/tasks/traffic-management/circuit-breaking/>Circuit Breaking</a>.</p><h3 id=fault-injection>Fault injection</h3><p>After you’ve configured your network, including failure recovery policies, you
|
||
can use Istio’s fault injection mechanisms to test the failure recovery capacity
|
||
of your application as a whole. Fault injection is a testing method that
|
||
introduces errors into a system to ensure that it can withstand and recover from
|
||
error conditions. Using fault injection can be particularly useful to ensure
|
||
that your failure recovery policies aren’t incompatible or too restrictive,
|
||
potentially resulting in critical services being unavailable.</p><p>Unlike other mechanisms for introducing errors such as delaying packets or
|
||
killing pods at the network layer, Istio’ lets you inject faults at the
|
||
application layer. This lets you inject more relevant failures, such as HTTP
|
||
error codes, to get more relevant results.</p><p>You can inject two types of faults, both configured using a
|
||
<a href=#virtual-services>virtual service</a>:</p><ul><li>Delays: Delays are timing failures. They mimic increased network latency or
|
||
an overloaded upstream service.</li><li>Aborts: Aborts are crash failures. They mimic failures in upstream services.
|
||
Aborts usually manifest in the form of HTTP error codes or TCP connection
|
||
failures.</li></ul><p>For example, this virtual service introduces a 5 second delay for 1 out of every 1000
|
||
requests to the <code>ratings</code> service.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: ratings
|
||
spec:
|
||
hosts:
|
||
- ratings
|
||
http:
|
||
- fault:
|
||
delay:
|
||
percentage:
|
||
value: 0.1
|
||
fixedDelay: 5s
|
||
route:
|
||
- destination:
|
||
host: ratings
|
||
subset: v1
|
||
</code></pre><p>For detailed instructions on how to configure delays and aborts, see
|
||
<a href=/v1.8/docs/tasks/traffic-management/fault-injection/>Fault Injection</a>.</p><h3 id=working-with-your-applications>Working with your applications</h3><p>Istio failure recovery features are completely transparent to the
|
||
application. Applications don’t know if an Envoy sidecar proxy is handling
|
||
failures for a called service before returning a response. This means that
|
||
if you are also setting failure recovery policies in your application code
|
||
you need to keep in mind that both work independently, and therefore might
|
||
conflict. For example, suppose you can have two timeouts, one configured in
|
||
a virtual service and another in the application. The application sets a 2
|
||
second timeout for an API call to a service. However, you configured a 3
|
||
second timeout with 1 retry in your virtual service. In this case, the
|
||
application’s timeout kicks in first, so your Envoy timeout and retry
|
||
attempt has no effect.</p><p>While Istio failure recovery features improve the reliability and
|
||
availability of services in the mesh, applications must handle the failure
|
||
or errors and take appropriate fallback actions. For example, when all
|
||
instances in a load balancing pool have failed, Envoy returns an <code>HTTP 503</code>
|
||
code. The application must implement any fallback logic needed to handle the
|
||
<code>HTTP 503</code> error code.</p><nav id=see-also><h2>See also</h2><div class=see-also><div class=entry><p class=link><a data-skipendnotes=true href=/v1.8/blog/2020/alb-ingress-gateway-iks/>Direct encrypted traffic from IBM Cloud Kubernetes Service Ingress to Istio Ingress Gateway</a></p><p class=desc>Configure the IBM Cloud Kubernetes Service Application Load Balancer to direct traffic to the Istio Ingress gateway with mutual TLS.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.8/blog/2020/multi-cluster-mesh-automation/>Multicluster Istio configuration and service discovery using Admiral</a></p><p class=desc>Automating Istio configuration for Istio deployments (clusters) that work as a single mesh.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.8/blog/2019/proxy/>Istio as a Proxy for External Services</a></p><p class=desc>Configure Istio ingress gateway to act as a proxy for external services.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.8/blog/2019/isolated-clusters/>Multi-Mesh Deployments for Isolation and Boundary Protection</a></p><p class=desc>Deploy environments that require isolation into separate meshes and enable inter-mesh communication by mesh federation.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.8/blog/2019/egress-traffic-control-in-istio-part-3/>Secure Control of Egress Traffic in Istio, part 3</a></p><p class=desc>Comparison of alternative solutions to control egress traffic including performance considerations.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.8/blog/2019/egress-traffic-control-in-istio-part-2/>Secure Control of Egress Traffic in Istio, part 2</a></p><p class=desc>Use Istio Egress Traffic Control to prevent attacks involving egress traffic.</p></div></div></nav></article><nav class=pagenav><div class=left><a title="Introduces Istio, the problems it solves, its high-level architecture, and its design goals." href=/v1.8/docs/concepts/what-is-istio/><svg class="icon left-arrow"><use xlink:href="/v1.8/img/icons.svg#left-arrow"/></svg>What is Istio?</a></div><div class=right><a title="Describes Istio's authorization and authentication functionality." href=/v1.8/docs/concepts/security/>Security<svg class="icon right-arrow"><use xlink:href="/v1.8/img/icons.svg#right-arrow"/></svg></a></div></nav><div id=feedback><div id=feedback-initial>Was this information useful?<br><button class="btn feedback" onclick="sendFeedback('en',1)">Yes</button>
|
||
<button class="btn feedback" onclick="sendFeedback('en',0)">No</button></div><div id=feedback-comment>Do you have any suggestions for improvement?<br><br><input id=feedback-textbox type=text placeholder="Help us improve..." data-lang=en></div><div id=feedback-thankyou>Thanks for your feedback!</div></div><div id=endnotes-container aria-hidden=true><h2>Links</h2><ol id=endnotes></ol></div></div><div class=toc-container><nav class=toc aria-label="Table of Contents"><div id=toc><ol><li role=none aria-label="Introducing Istio traffic management"><a href=#introducing-istio-traffic-management>Introducing Istio traffic management</a><li role=none aria-label="Virtual services"><a href=#virtual-services>Virtual services</a><ol><li role=none aria-label="Why use virtual services?"><a href=#why-use-virtual-services>Why use virtual services?</a><li role=none aria-label="Virtual service example"><a href=#virtual-service-example>Virtual service example</a><ol><li role=none aria-label="The hosts field"><a href=#the-hosts-field>The hosts field</a><li role=none aria-label="Routing rules"><a href=#routing-rules>Routing rules</a><ol><li role=none aria-label="Match condition"><a href=#match-condition>Match condition</a><li role=none aria-label=Destination><a href=#destination>Destination</a></ol></li><li role=none aria-label="Routing rule precedence"><a href=#routing-rule-precedence>Routing rule precedence</a></ol></li><li role=none aria-label="More about routing rules"><a href=#more-about-routing-rules>More about routing rules</a></ol></li><li role=none aria-label="Destination rules"><a href=#destination-rules>Destination rules</a><ol><li role=none aria-label="Load balancing options"><a href=#load-balancing-options>Load balancing options</a><li role=none aria-label="Destination rule example"><a href=#destination-rule-example>Destination rule example</a></ol></li><li role=none aria-label=Gateways><a href=#gateways>Gateways</a><ol><li role=none aria-label="Gateway example"><a href=#gateway-example>Gateway example</a></ol></li><li role=none aria-label="Service entries"><a href=#service-entries>Service entries</a><ol><li role=none aria-label="Service entry example"><a href=#service-entry-example>Service entry example</a></ol></li><li role=none aria-label=Sidecars><a href=#sidecars>Sidecars</a><li role=none aria-label="Network resilience and testing"><a href=#network-resilience-and-testing>Network resilience and testing</a><ol><li role=none aria-label=Timeouts><a href=#timeouts>Timeouts</a><li role=none aria-label=Retries><a href=#retries>Retries</a><li role=none aria-label="Circuit breakers"><a href=#circuit-breakers>Circuit breakers</a><li role=none aria-label="Fault injection"><a href=#fault-injection>Fault injection</a><li role=none aria-label="Working with your applications"><a href=#working-with-your-applications>Working with your applications</a></ol></li><li role=none aria-label="See also"><a href=#see-also>See also</a></li></ol></div></nav></div></main><footer><div class=user-links><a class=channel title="Go download Istio 1.8.3 now" href=/v1.8/docs/setup/getting-started/#download aria-label="Download Istio"><span>download</span><svg class="icon download"><use xlink:href="/v1.8/img/icons.svg#download"/></svg>
|
||
</a><a class=channel title="Join the Istio discussion board to participate in discussions and get help troubleshooting problems" href=https://discuss.istio.io aria-label="Istio discussion board"><span>discuss</span><svg class="icon discourse"><use xlink:href="/v1.8/img/icons.svg#discourse"/></svg></a>
|
||
<a class=channel title="Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio" href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><span>stack overflow</span><svg class="icon stackoverflow"><use xlink:href="/v1.8/img/icons.svg#stackoverflow"/></svg></a>
|
||
<a class=channel title="Interactively discuss issues with the Istio community on Slack" href=https://slack.istio.io aria-label=slack><span>slack</span><svg class="icon slack"><use xlink:href="/v1.8/img/icons.svg#slack"/></svg></a>
|
||
<a class=channel title="Follow us on Twitter to get the latest news" href=https://twitter.com/IstioMesh aria-label=Twitter><span>twitter</span><svg class="icon twitter"><use xlink:href="/v1.8/img/icons.svg#twitter"/></svg></a><div class=tag>for everyone</div></div><div class=info><p class=copyright>Istio Archive
|
||
1.8.3<br>© 2020 Istio Authors, <a href=https://policies.google.com/privacy>Privacy Policy</a><br>Archived on February 9, 2021</p></div><div class=dev-links><a class=channel title="GitHub is where development takes place on Istio code" href=https://github.com/istio/community aria-label=GitHub><span>github</span><svg class="icon github"><use xlink:href="/v1.8/img/icons.svg#github"/></svg></a>
|
||
<a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><span>drive</span><svg class="icon drive"><use xlink:href="/v1.8/img/icons.svg#drive"/></svg></a>
|
||
<a class=channel title="If you'd like to contribute to the Istio project, consider participating in our working groups" href=https://github.com/istio/community/blob/master/WORKING-GROUPS.md aria-label="working groups"><span>working groups</span><svg class="icon working-groups"><use xlink:href="/v1.8/img/icons.svg#working-groups"/></svg></a><div class=tag>for developers</div></div></footer><script src=https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js defer></script><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title="Back to top"><svg class="icon top"><use xlink:href="/v1.8/img/icons.svg#top"/></svg></button></div></body></html> |