mirror of https://github.com/istio/istio.io.git
217 lines
71 KiB
HTML
217 lines
71 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=x-ua-compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content="#466BB0"><meta name=title content="FAQ"><meta name=description content="Frequently Asked Questions about Istio."><meta name=keywords content="microservices,services,mesh"><meta property="og:title" content="FAQ"><meta property="og:type" content="website"><meta property="og:description" content="Frequently Asked Questions about Istio."><meta property="og:url" content="/v1.14/about/faq/"><meta property="og:image" content="https://raw.githubusercontent.com/istio/istio.io/master/static/img/istio-whitelogo-bluebackground-framed.svg"><meta property="og:image:alt" content="Istio Logo"><meta property="og:image:width" content="1024"><meta property="og:image:height" content="1024"><meta property="og:site_name" content="Istio"><meta name=twitter:card content="summary"><meta name=twitter:site content="@IstioMesh"><title>Istioldie 1.14 / FAQ</title><script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script>
|
||
<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","UA-98480406-2")</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.14/blog/feed.xml><link rel=alternate type=application/rss+xml title="Istio News" href=/v1.14/news/feed.xml><link rel=alternate type=application/rss+xml title="Istio Blog and News" href=/v1.14/feed.xml><link rel="shortcut icon" href=/v1.14/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.14/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.14/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.14/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.14/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.14/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.14/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.14/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.14/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.14/favicons/android-192x192.png sizes=192x192><link rel=icon type=image/svg+xml href=/v1.14/favicons/favicon.svg><link rel=icon type=image/png href=/v1.14/favicons/favicon.png><link rel=mask-icon href=/v1.14/favicons/safari-pinned-tab.svg color=#466bb0><link rel=manifest href=/v1.14/manifest.json><meta name=apple-mobile-web-app-title content="Istio"><meta name=application-name content="Istio"><meta name=msapplication-config content="/browserconfig.xml"><meta name=msapplication-TileColor content="#466BB0"><meta name=theme-color content="#466BB0"><link rel=stylesheet href=/v1.14/css/all.css><link rel=preconnect href=https://fonts.gstatic.com><link rel=stylesheet href="https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&display=swap"><script src=/v1.14/js/themes_init.min.js></script></head><body class="language-unknown archive-site"><script>const branchName="release-1.14",docTitle="FAQ",iconFile="/v1.14/img/icons.svg",buttonCopy="Copy to clipboard",buttonPrint="Print",buttonDownload="Download"</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script>
|
||
<script src=/v1.14/js/all.min.js data-manual defer></script><header class=main-navigation><nav class="main-navigation-wrapper container-l"><div class=main-navigation-header><a id=brand href=/v1.14/ aria-label=logotype><span class=logo><svg xmlns="http://www.w3.org/2000/svg" width="128" height="60" viewBox="0 0 128 60"><path d="M58.434 48.823A.441.441.0 0158.3 48.497V22.583a.444.444.0 01.134-.326.446.446.0 01.327-.134h3.527a.447.447.0 01.325.134.447.447.0 01.134.326v25.914a.443.443.0 01-.134.326.444.444.0 01-.325.134h-3.527a.444.444.0 01-.327-.134z"/><path d="m70.969 48.477a6.556 6.556.0 01-2.818-1.955 4.338 4.338.0 01-1-2.78v-.345a.443.443.0 01.134-.326.444.444.0 01.326-.135h3.374a.444.444.0 01.326.135.445.445.0 01.134.326v.077a2.014 2.014.0 001.054 1.667 4.672 4.672.0 002.664.709 4.446 4.446.0 002.492-.633 1.862 1.862.0 00.958-1.591 1.426 1.426.0 00-.786-1.322 12.7 12.7.0 00-2.549-.939l-1.457-.46a21.526 21.526.0 01-3.3-1.227 6.57 6.57.0 01-2.262-1.783 4.435 4.435.0 01-.92-2.894 5.081 5.081.0 012.109-4.275 8.993 8.993.0 015.558-1.591 10.445 10.445.0 014.1.748 6.3 6.3.0 012.722 2.07 5 5 0 01.958 3.009.441.441.0 01-.134.326.441.441.0 01-.325.134h-3.258a.441.441.0 01-.326-.134.443.443.0 01-.134-.326 1.974 1.974.0 00-.978-1.667 4.647 4.647.0 00-2.665-.671 4.741 4.741.0 00-2.435.556 1.724 1.724.0 00-.938 1.553 1.512 1.512.0 00.9 1.4 15.875 15.875.0 003.01 1.055l.843.229a27.368 27.368.0 013.412 1.246 6.67 6.67.0 012.338 1.763 4.387 4.387.0 01.958 2.933 4.988 4.988.0 01-2.146 4.275 9.543 9.543.0 01-5.712 1.552 11.626 11.626.0 01-4.227-.709z"/><path d="m97.039 32.837a.443.443.0 01-.326.135h-3.911a.169.169.0 00-.191.192v9.239a2.951 2.951.0 00.632 2.108 2.7 2.7.0 002.013.652h1.15a.444.444.0 01.325.134.441.441.0 01.134.326v2.875a.471.471.0 01-.459.5l-1.994.039a8 8 0 01-4.524-1.035q-1.495-1.035-1.533-3.91V33.166A.17.17.0 0088.164 32.974H85.978A.441.441.0 0185.652 32.839.441.441.0 0185.518 32.513V29.83a.441.441.0 01.134-.326.444.444.0 01.326-.135h2.186a.169.169.0 00.191-.192v-4.485a.438.438.0 01.134-.326.44.44.0 01.325-.134h3.336a.443.443.0 01.325.134.442.442.0 01.135.326v4.485a.169.169.0 00.191.192h3.911a.446.446.0 01.326.135.446.446.0 01.134.326v2.683a.446.446.0 01-.133.324z"/><path d="m101.694 25.917a2.645 2.645.0 01-.767-1.955 2.65 2.65.0 01.767-1.955 2.65 2.65.0 011.955-.767 2.65 2.65.0 011.955.767 2.652 2.652.0 01.767 1.955 2.647 2.647.0 01-.767 1.955 2.646 2.646.0 01-1.955.767 2.645 2.645.0 01-1.955-.767zm-.211 22.906a.441.441.0 01-.134-.326V29.79a.444.444.0 01.134-.326.446.446.0 01.326-.134h3.527a.446.446.0 01.326.134.445.445.0 01.134.326v18.707a.443.443.0 01-.134.326.443.443.0 01-.326.134h-3.527a.443.443.0 01-.326-.134z"/><path d="m114.019 47.734a8.1 8.1.0 01-3.047-4.255 14.439 14.439.0 01-.652-4.37 14.3 14.3.0 01.614-4.371A7.869 7.869.0 01114 30.56a9.072 9.072.0 015.252-1.5 8.543 8.543.0 015.041 1.5 7.985 7.985.0 013.009 4.14 12.439 12.439.0 01.69 4.37 13.793 13.793.0 01-.651 4.37 8.255 8.255.0 01-3.028 4.275 8.475 8.475.0 01-5.1 1.553 8.754 8.754.0 01-5.194-1.534zm7.629-3.1a4.536 4.536.0 001.476-2.262 11.335 11.335.0 00.383-3.221 10.618 10.618.0 00-.383-3.22 4.169 4.169.0 00-1.457-2.243 4.066 4.066.0 00-2.531-.785 3.942 3.942.0 00-2.453.785 4.376 4.376.0 00-1.5 2.243 11.839 11.839.0 00-.383 3.22 11.84 11.84.0 00.383 3.221 4.222 4.222.0 001.476 2.262 4.075 4.075.0 002.549.8 3.8 3.8.0 002.44-.809z"/><path d="m15.105 32.057v15.565a.059.059.0 01-.049.059L.069 50.25A.06.06.0 01.005 50.167l14.987-33.47a.06.06.0 01.114.025z"/><path d="m17.631 23.087v24.6a.06.06.0 00.053.059l22.449 2.507a.06.06.0 00.061-.084L17.745.032a.06.06.0 00-.114.024z"/><path d="m39.961 52.548-24.833 7.45a.062.062.0 01-.043.0L.079 52.548a.059.059.0 01.026-.113h39.839a.06.06.0 01.017.113z"/></svg></span></a><button id=hamburger class=main-navigation-toggle aria-label="Open navigation"><svg class="icon menu-hamburger"><use xlink:href="/v1.14/img/icons.svg#menu-hamburger"/></svg></button>
|
||
<button id=menu-close class=main-navigation-toggle aria-label="Close navigation"><svg class="icon menu-close"><use xlink:href="/v1.14/img/icons.svg#menu-close"/></svg></button></div><div id=header-links class=main-navigation-links-wrapper><ul class=main-navigation-links><li class=main-navigation-links-item><a class="main-navigation-links-link has-dropdown"><span>About</span><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></a><ul class=main-navigation-links-dropdown><li class=main-navigation-links-dropdown-item><a href=/v1.14/about/service-mesh class=main-navigation-links-link>Service mesh</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.14/about/solutions class=main-navigation-links-link>Solutions</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.14/about/case-studies class=main-navigation-links-link>Case studies</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.14/about/ecosystem class=main-navigation-links-link>Ecosystem</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.14/about/deployment class=main-navigation-links-link>Deployment</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.14/about/faq class=main-navigation-links-link>FAQ</a></li></ul></li><li class=main-navigation-links-item><a href=/v1.14/blog/ class=main-navigation-links-link><span>Blog</span></a></li><li class=main-navigation-links-item><a href=/v1.14/news/ class=main-navigation-links-link><span>News</span></a></li><li class=main-navigation-links-item><a href=/v1.14/get-involved/ class=main-navigation-links-link><span>Get involved</span></a></li><li class=main-navigation-links-item><a href=/v1.14/docs/ class=main-navigation-links-link><span>Documentation</span></a></li></ul><div class=main-navigation-footer><button id=search-show class=search-show title="Search this site" aria-label=Search><svg class="icon magnifier"><use xlink:href="/v1.14/img/icons.svg#magnifier"/></svg></button>
|
||
<a href=/v1.14/docs/setup/getting-started class="btn btn--primary" id=try-istio>Try Istio</a></div></div><form id=search-form class=search name=cse role=search><input type=hidden name=cx value=002184991200833970123:iwwf17ikgf4>
|
||
<input type=hidden name=ie value=utf-8>
|
||
<input type=hidden name=hl value=en>
|
||
<input type=hidden id=search-page-url value=/search>
|
||
<input id=search-textbox class="search-textbox form-control" name=q type=search aria-label="Search this site" placeholder=Search>
|
||
<button id=search-close title="Cancel search" type=reset aria-label="Cancel search"><svg class="icon menu-close"><use xlink:href="/v1.14/img/icons.svg#menu-close"/></svg></button></form></nav></header><div class=banner-container></div><nav aria-label=Breadcrumb class=container-l><ol><li><a href title="Get a bit more in-depth info about the Istio project.">About</a><svg class="icon breadcrumb-arrow"><use xlink:href="/v1.14/img/icons.svg#breadcrumb-arrow"/></svg></li><li>FAQ</li></ol></nav><main class="primary container about has-toc"><div class=article-container><article aria-labelledby=title><div class=title-area><div style=width:100%><h1 id=title>FAQ</h1><p class=subtitle>In your search for information about Istio and service mesh technology, we hope this FAQ helps!</p></div></div><div><h2 id=general>General</h2><div class="faq-block faq-block--collapsed" id=what-is-istio><div class=faq-block-question><span class=faq-block-question__text>What is Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection.</p><p><em>Open</em>: Istio is being developed and maintained as open-source software. We encourage contributions and feedback from the community at-large.</p><p><em>Platform-independent</em>: Istio is not targeted at any specific deployment environment. During the initial stages of development, Istio will support
|
||
Kubernetes-based deployments. However, Istio is being built to enable rapid and easy adaptation to other environments.</p><p><em>Service mesh</em>: Istio is designed to manage communications between microservices and applications. Without requiring changes to the underlying services, Istio provides automated baseline traffic resilience, service metrics collection, distributed tracing, traffic encryption, protocol upgrades, and advanced routing functionality for all service-to-service communication.</p><p>For more detail, please see <a href=/v1.14/about/service-mesh/>The Istio service mesh</a></p></div></div><div class="faq-block faq-block--collapsed" id=why-use-istio><div class=faq-block-question><span class=faq-block-question__text>Why would I want to use Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Traditionally, much of the logic handled by Istio has been built directly into applications. Across a fleet of services, managing updates to this communications logic can be a large burden. Istio provides an infrastructure-level solution to managing service communications.</p><p><em>Application developers</em>: With Istio managing how traffic flows across their services, developers can focus exclusively on business logic and iterate quickly on new features.</p><p><em>Service operators</em>: Istio enables policy enforcement and mesh monitoring from a single centralized control point, independent of application evolution. As a result, operators can ensure continuous policy compliance through a simplified management plane.</p></div></div><div class="faq-block faq-block--collapsed" id=how-do-i-get-started><div class=faq-block-question><span class=faq-block-question__text>How do I get started using Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>We recommend following the instructions on the <a href=/v1.14/docs/setup/getting-started/>getting started page</a>,
|
||
which installs a demonstration configuration along with Istio’s premier sample application,
|
||
<a href=/v1.14/docs/examples/bookinfo/>Bookinfo</a>.
|
||
You can then use this setup to <a href=/v1.14/docs/setup/getting-started/#next-steps>walk through various Istio guides</a>
|
||
that showcase intelligent routing, policy enforcement, security, telemetry, etc., in a tutorial style.</p><p>To start using Istio with production Kubernetes deployments, please refer to our
|
||
<a href=/v1.14/docs/ops/deployment/deployment-models/>deployment models</a> documentation and the
|
||
<a href=/v1.14/about/faq/#install-method-selection>which Istio installation method should I use?</a>
|
||
FAQ page.</p></div></div><div class="faq-block faq-block--collapsed" id=what-is-the-license><div class=faq-block-question><span class=faq-block-question__text>What is the license?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio uses the <a href=https://www.apache.org/licenses/LICENSE-2.0.html>Apache License 2.0</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=how-was-istio-started><div class=faq-block-question><span class=faq-block-question__text>How was Istio started?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>The Istio project was started by teams from Google and IBM in partnership with the Envoy team from Lyft. It’s been
|
||
developed fully in the open on GitHub.</p></div></div><div class="faq-block faq-block--collapsed" id=what-deployment-environment><div class=faq-block-question><span class=faq-block-question__text>What deployment environments are supported?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio is designed to be platform-independent, initially focused on Kubernetes.
|
||
For our 1.14 release, Istio supports environments running
|
||
Kubernetes (1.21, 1.22, 1.23, 1.24).</p></div></div><div class="faq-block faq-block--collapsed" id=how-do-i-contribute><div class=faq-block-question><span class=faq-block-question__text>How can I contribute?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Contributions are highly welcome. We look forward to community feedback, additions, and bug reports.</p><p>The code repositories are hosted on <a href=https://github.com/istio>GitHub</a>. Please see our <a href=https://github.com/istio/community/blob/master/CONTRIBUTING.md>Contribution Guidelines</a> to learn how to contribute.</p><p>In addition to the code, there are <a href=/v1.14/get-involved/>other ways to contribute to the Istio community</a>, including on our <a href=https://discuss.istio.io>discussion forum</a>,
|
||
<a href=https://slack.istio.io>Slack</a>, and <a href=https://stackoverflow.com/questions/tagged/istio>Stack Overflow</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=where-is-the-documentation><div class=faq-block-question><span class=faq-block-question__text>Where is the documentation?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Check out the <a href=/v1.14/docs/>documentation</a> right here on istio.io. The docs include
|
||
<a href=/v1.14/docs/concepts/>concept overviews</a>,
|
||
<a href=/v1.14/docs/tasks/>task guides</a>,
|
||
<a href=/v1.14/docs/examples/>examples</a>,
|
||
and the <a href=/v1.14/docs/reference/>complete reference documentation</a>.</p><p>Detailed developer-level documentation is maintained on our <a href=https://github.com/istio/istio/wiki>Wiki</a></p></div></div><div class="faq-block faq-block--collapsed" id=istio-doesnt-work><div class=faq-block-question><span class=faq-block-question__text>Istio doesn't work - what do I do?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Check out the <a href=/v1.14/docs/ops/>operations guide</a> for finding solutions and our
|
||
<a href=/v1.14/docs/releases/bugs/>bug reporting</a> page for filing bugs.</p></div></div><div class="faq-block faq-block--collapsed" id=roadmap><div class=faq-block-question><span class=faq-block-question__text>What is Istio's roadmap?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>See our <a href=/v1.14/docs/releases/feature-stages/>feature stages page</a>
|
||
and <a href=/v1.14/news>news</a> for latest happenings.</p></div></div><div class="faq-block faq-block--collapsed" id=what-does-istio-mean><div class=faq-block-question><span class=faq-block-question__text>What does the word 'Istio' mean?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>It’s the Greek word for ‘sail’.</p></div></div><div class="faq-block faq-block--collapsed" id=how-to-join-slack><div class=faq-block-question><span class=faq-block-question__text>How can I join the Istio Slack workspace?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>If you’d like to have live interactions with members of our community, you can join us on
|
||
<a href=https://slack.istio.io>Istio’s Slack</a> workspace.</p></div></div><h2 id=setup>Setup</h2><div class="faq-block faq-block--collapsed" id=install-method-selection><div class=faq-block-question><span class=faq-block-question__text>Which Istio installation method should I use?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>In addition to the simple <a href=/v1.14/docs/setup/getting-started>getting started</a> evaluation install, there are several different
|
||
methods you can use to install Istio. Which one you should use depends on your production requirements.
|
||
The following lists some of the pros and cons of each of the available methods:</p><ol><li><p><a href=/v1.14/docs/setup/install/istioctl/>istioctl install</a></p><p>The simplest and most qualified installation and management path with high security.
|
||
This is the community recommended method for most use cases.</p><p>Pros:</p><ul><li>Thorough configuration validation and health verification.</li><li>Uses the <code>IstioOperator</code> API which provides extensive configuration/customization options.</li><li>No in-cluster privileged pods needed. Changes are actuated by running the <code>istioctl</code> command.</li></ul><p>Cons:</p><ul><li>Multiple binaries must be managed, one per Istio minor version.</li><li>The <code>istioctl</code> command can set values like <code>JWT_POLICY</code> based on your running environment,
|
||
thereby producing varying installations in different Kubernetes environments.</li></ul></li><li><p><a href=/v1.14/docs/setup/install/istioctl/#generate-a-manifest-before-installation>istioctl manifest generate</a></p><p>Generate the Kubernetes manifest and then apply with <code>kubectl apply --prune</code>.
|
||
This method is suitable where strict auditing or augmentation of output manifests is needed.</p><p>Pros:</p><ul><li>Resources are generated from the same <code>IstioOperator</code> API as used in <code>istioctl install</code> and Operator.</li><li>Uses the <code>IstioOperator</code> API which provides extensive configuration/customization options.</li></ul><p>Cons:</p><ul><li>Some checks performed in <code>istioctl install</code> and Operator are not done.</li><li>UX is less streamlined compared to <code>istioctl install</code>.</li><li>Error reporting is not as robust as <code>istioctl install</code> for the apply step.</li></ul></li><li><p><a href=/v1.14/docs/setup/install/helm/>Install using Helm (alpha)</a></p><p>Using Helm charts allows easy integration with Helm based workflows and automated resource pruning during upgrades.</p><p>Pros:</p><ul><li>Familiar approach using industry standard tooling.</li><li>Helm native release and upgrade management.</li></ul><p>Cons:</p><ul><li>Fewer checks and validations compared to <code>istioctl install</code> and Operator.</li><li>Some administrative tasks require more steps and have higher complexity.</li></ul></li><li><p><a href=/v1.14/docs/setup/install/operator/>Istio Operator</a></p><div><aside class="callout warning"><div class=type><svg class="large-icon"><use xlink:href="/v1.14/img/icons.svg#callout-warning"/></svg></div><div class=content>Using the operator is not recommended for new installations. While the operator will continue to be supported,
|
||
new feature requests will not be prioritized.</div></aside></div><p>The Istio operator provides an installation path without needing the <code>istioctl</code> binary.
|
||
This can be used for simplified upgrade workflows where running an in-cluster privileged controller is not a concern.
|
||
This method is suitable where strict auditing or augmentation of output manifests is not needed.</p><p>Pros:</p><ul><li>Same API as <code>istioctl install</code> but actuation is through a controller pod in the cluster with a fully declarative operation.</li><li>Uses the <code>IstioOperator</code> API which provides extensive configuration/customization options.</li><li>No need to manage multiple <code>istioctl</code> binaries.</li></ul><p>Cons:</p><ul><li>High privilege controller running in the cluster poses security risks.</li></ul></li></ol><p>Installation instructions for all of these methods are available on the <a href=/v1.14/docs/setup/install>Istio install page</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=k8s-sidecar-injection-not-working><div class=faq-block-question><span class=faq-block-question__text>Kubernetes - How can I debug problems with automatic sidecar injection?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Ensure that your cluster has met the
|
||
<a href=/v1.14/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection>prerequisites</a> for
|
||
the automatic sidecar injection. If your microservice is deployed in
|
||
<code>kube-system</code>, <code>kube-public</code> or <code>istio-system</code> namespaces, they are exempted
|
||
from automatic sidecar injection. Please use a different namespace
|
||
instead.</p></div></div><h2 id=security>Security</h2><div class="faq-block faq-block--collapsed" id=enabling-disabling-mtls><div class=faq-block-question><span class=faq-block-question__text>How can I enable/disable mutual TLS after I installed Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>You can change mutual TLS settings for your services at any time using <a href=/v1.14/docs/concepts/security/#authentication-policies>authentication policy</a>
|
||
and <a href=/v1.14/docs/concepts/traffic-management/#destination-rules>destination rule</a>. See <a href=/v1.14/docs/tasks/security/authentication/authn-policy>task</a> for more details.</p></div></div><div class="faq-block faq-block--collapsed" id=auth-mix-and-match><div class=faq-block-question><span class=faq-block-question__text>Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p><a href=/v1.14/docs/concepts/security/#authentication-policies>Authentication policy</a> can be mesh-wide (which affects all services in the mesh), namespace-wide
|
||
(all services in the same namespace), or service specific. You can have policy or policies to setup mutual TLS for services in a cluster in any way as you want.</p></div></div><div class="faq-block faq-block--collapsed" id=verify-mtls-encryption><div class=faq-block-question><span class=faq-block-question__text>How can I verify that traffic is using mutual TLS encryption?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>If you installed Istio with <code>values.global.proxy.privileged=true</code>, you can use <code>tcpdump</code> to determine encryption status. Also in Kubernetes 1.23 and later, as an alternative to installing Istio as privileged, you can use <code>kubectl debug</code> to run <code>tcpdump</code> in an <a href=https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-container>ephemeral container</a>. See <a href=/v1.14/docs/tasks/security/authentication/mtls-migration>Istio mutual TLS migration</a> for instructions.</p></div></div><div class="faq-block faq-block--collapsed" id=non-istio-to-istio><div class=faq-block-question><span class=faq-block-question__text>If mutual TLS is globally enabled, can non-Istio services access Istio services?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>When <code>STRICT</code> mutual TLS is enabled, non-Istio workloads cannot communicate to Istio services, as they will not have a valid Istio client certificate.</p><p>If you need to allow these clients, the mutual TLS mode can be configured to <code>PERMISSIVE</code>, allowing both plaintext and mutual TLS.
|
||
This can be done for individual workloads or the entire mesh.</p><p>See <a href=/v1.14/docs/tasks/security/authentication/authn-policy>Authentication Policy</a> for more details.</p></div></div><div class="faq-block faq-block--collapsed" id=k8s-health-checks><div class=faq-block-question><span class=faq-block-question__text>How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>If mutual TLS is enabled, HTTP and TCP health checks from the kubelet will not work without modification, since the kubelet does not have Istio-issued certificates.</p><p>There are several options:</p><ol><li><p>Using probe rewrite to redirect liveness and readiness requests to the
|
||
workload directly. Please refer to <a href=/v1.14/docs/ops/configuration/mesh/app-health-check/#probe-rewrite>Probe Rewrite</a>
|
||
for more information. This is enabled by default and recommended.</p></li><li><p>Using a separate port for health checks and enabling mutual TLS only on the regular service port. Please refer to <a href=/v1.14/docs/ops/configuration/mesh/app-health-check/#separate-port>Health Checking of Istio Services</a> for more information.</p></li><li><p>Using the <a href=/v1.14/docs/tasks/security/authentication/mtls-migration><code>PERMISSIVE</code> mode</a> for the workload, so it can accept both plaintext and mutual TLS traffic. Please keep in mind that mutual TLS is not enforced with this option.</p></li></ol></div></div><div class="faq-block faq-block--collapsed" id=cert-lifetime-config><div class=faq-block-question><span class=faq-block-question__text>How to configure the lifetime for Istio certificates?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>For the workloads running in Kubernetes, the lifetime of their Istio certificates is by default 24 hours.</p><p>This configuration may be overridden by customizing the <code>proxyMetadata</code> field of the <a href=/v1.14/docs/reference/config/istio.mesh.v1alpha1/#ProxyConfig>proxy configuration</a>. For example:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>proxyMetadata:
|
||
SECRET_TTL: 48h
|
||
</code></pre><div><aside class="callout tip"><div class=type><svg class="large-icon"><use xlink:href="/v1.14/img/icons.svg#callout-tip"/></svg></div><div class=content>Values over 90 days will not be accepted.</div></aside></div></div></div><div class="faq-block faq-block--collapsed" id=automtls-exclude-port><div class=faq-block-question><span class=faq-block-question__text>Does Auto mutual TLS exclude ports set using "excludeInboundPorts" annotation?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>No. When <code>traffic.sidecar.istio.io/excludeInboundPorts</code> is used on server workloads, Istio still
|
||
configures the client Envoy to send mutual TLS by default. To change that, you need to configure
|
||
a Destination Rule with mutual TLS mode set to <code>DISABLE</code> to have clients send plain text to those
|
||
ports.</p></div></div><div class="faq-block faq-block--collapsed" id=mysql-with-mtls><div class=faq-block-question><span class=faq-block-question__text>MySQL Connectivity Troubleshooting</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>You may find MySQL can’t connect after installing Istio. This is because MySQL is a <a href=/v1.14/docs/ops/deployment/requirements/#server-first-protocols>server first</a> protocol,
|
||
which can interfere with Istio’s protocol detection. In particular, using <code>PERMISSIVE</code> mTLS mode, may cause issues.
|
||
You may see error messages such as <code>ERROR 2013 (HY000): Lost connection to MySQL server at
|
||
'reading initial communication packet', system error: 0</code>.</p><p>This can be fixed by ensuring <code>STRICT</code> or <code>DISABLE</code> mode is used, or that all clients are configured
|
||
to send mTLS. See <a href=/v1.14/docs/ops/deployment/requirements/#server-first-protocols>server first protocols</a> for more information.</p></div></div><div class="faq-block faq-block--collapsed" id=does-istio-support-authorization><div class=faq-block-question><span class=faq-block-question__text>Does Istio support authorization?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Yes. Istio provides authorization features for both HTTP and plain TCP services in the mesh.
|
||
<a href=/v1.14/docs/concepts/security/#authorization>Learn more</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=secure-ingress><div class=faq-block-question><span class=faq-block-question__text>How to configure Istio Ingress to only accept TLS traffic?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>By following the instructions in the
|
||
<a href=/v1.14/docs/tasks/traffic-management/ingress/secure-ingress>Secure Ingress Traffic</a> task,
|
||
Istio Ingress can be secured to only accept TLS traffic.</p></div></div><div class="faq-block faq-block--collapsed" id=https-overlay><div class=faq-block-question><span class=faq-block-question__text>Can I install Istio sidecar for HTTPS services?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Yes, you can. It works both with mutual TLS enabled and disabled.</p></div></div><h2 id=metrics-and-logs>Metrics and Logs</h2><div class="faq-block faq-block--collapsed" id=accessing-telemetry-via-rest><div class=faq-block-question><span class=faq-block-question__text>Can Istio metrics be accessed through REST?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>You can collect telemetry data about Istio using <a href=/v1.14/docs/tasks/observability/metrics/querying-metrics/>Prometheus</a>. And then use
|
||
<a href=https://prometheus.io/docs/prometheus/latest/querying/api/>Prometheus’s HTTP API</a> to query that data.</p></div></div><div class="faq-block faq-block--collapsed" id=telemetry-v1-vs-v2><div class=faq-block-question><span class=faq-block-question__text>What are the differences in telemetry reported by in-proxy telemetry (aka v2) and Mixer-based telemetry (aka v1)?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>In-proxy telemetry (aka v2) reduces resource cost and improves proxy
|
||
performance as compared to the Mixer-based telemetry (aka v1) approach,
|
||
and is the preferred mechanism for surfacing telemetry in Istio.
|
||
However, there are few differences in reported telemetry between v1 and
|
||
v2 which are listed below:</p><ul><li><p><strong>Missing labels for out-of-mesh traffic</strong>
|
||
In-proxy telemetry relies on metadata exchange between Envoy proxies to gather
|
||
information like peer workload name, namespace and labels. In Mixer-based telemetry
|
||
this functionality was performed by Mixer as part of combining request attributes
|
||
with the platform data. This metadata exchange is performed by the Envoy proxies
|
||
by adding a specific HTTP header for HTTP protocol or augmenting
|
||
ALPN protocol for TCP protocol as described
|
||
<a href=/v1.14/docs/tasks/observability/metrics/tcp-metrics/#understanding-tcp-telemetry-collection>here</a>.
|
||
This requires Envoy proxies to be injected at both the client & server workloads,
|
||
implying that the telemetry reported when one peer is not in the mesh will be
|
||
missing peer attributes like workload name, namespace and labels.
|
||
However, if both peers have proxies injected all the labels mentioned
|
||
<a href=/v1.14/docs/reference/config/metrics/>here</a> are available in the generated metrics.
|
||
When the server workload is out of the mesh, server workload metadata is still
|
||
distributed to client sidecar, causing client side metrics to have server workload
|
||
metadata labels filled.</p></li><li><p><strong>TCP metadata exchange requires mTLS</strong>
|
||
TCP metadata exchange relies on the <a href=/v1.14/docs/tasks/observability/metrics/tcp-metrics/#understanding-tcp-telemetry-collection>Istio ALPN protocol</a>
|
||
which requires mutual TLS (mTLS) to be enabled for the Envoy proxies
|
||
to exchange metadata successfully. This implies that if mTLS is not
|
||
enabled in your cluster, telemetry for TCP protocol will not include
|
||
peer information like workload name, namespace and labels.</p></li><li><p><strong>No mechanism for configuring custom buckets for histogram metrics</strong>
|
||
Mixer-based telemetry supported customizing buckets for histogram type metrics
|
||
like request duration and TCP byte sizes. In-proxy telemetry has no such
|
||
available mechanism. Additionally, the buckets available for latency metrics
|
||
in in-proxy telemetry are in milliseconds as compared to seconds
|
||
in Mixer-based telemetry. However, more buckets are available by default
|
||
in in-proxy telemetry for latency metrics at the lower latency levels.</p></li><li><p><strong>No metric expiration for short-lived metrics</strong>
|
||
Mixer-based telemetry supported metric expiration whereby metrics which were
|
||
not generated for a configurable amount of time were de-registered for
|
||
collection by Prometheus. This is useful in scenarios, such as one-off jobs, that generate short-lived metrics. De-registering
|
||
the metrics prevents reporting of metrics which would no longer change in the
|
||
future, thereby reducing network traffic and storage in Prometheus.
|
||
This expiration mechanism is not available in in-proxy telemetry.
|
||
The workaround for this can be found <a href=/v1.14/about/faq/#metric-expiry>here</a>.</p></li></ul></div></div><div class="faq-block faq-block--collapsed" id=metric-expiry><div class=faq-block-question><span class=faq-block-question__text>How can I manage short-lived metrics?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Short-lived metrics can hamper the performance of Prometheus, as they often are a large source of label cardinality. Cardinality is a measure of the number of unique values for a label. To manage the impact of your short-lived metrics on Prometheus, you must first identify the high cardinality metrics and labels. Prometheus provides cardinality information at its <code>/status</code> page. Additional information can be retrieved <a href=https://www.robustperception.io/which-are-my-biggest-metrics>via PromQL</a>.
|
||
There are several ways to reduce the cardinality of Istio metrics:</p><ul><li>Disable host header fallback.
|
||
The <code>destination_service</code> label is one potential source of high-cardinality.
|
||
The values for <code>destination_service</code> default to the host header if the Istio proxy is not able to determine the destination service from other request metadata.
|
||
If clients are using a variety of host headers, this could result in a large number of values for the <code>destination_service</code>.
|
||
In this case, follow the <a href=/v1.14/docs/tasks/observability/metrics/customize-metrics/>metric customization</a> guide to disable host header fallback mesh wide.
|
||
To disable host header fallback for a particular workload or namespace, you need to copy the stats <code>EnvoyFilter</code> configuration, update it to have host header fallback disabled, and apply it with a more specific selector.
|
||
<a href=https://github.com/istio/istio/issues/25963#issuecomment-666037411>This issue</a> has more detail on how to achieve this.</li><li>Drop unnecessary labels from collection. If the label with high cardinality is not needed, you can drop it from metric collection via <a href=/v1.14/docs/tasks/observability/metrics/customize-metrics/>metric customization</a> using <code>tags_to_remove</code>.</li><li>Normalize label values, either through federation or classification.
|
||
If the information provided by the label is desired, you can use <a href=/v1.14/docs/ops/best-practices/observability/#using-prometheus-for-production-scale-monitoring>Prometheus federation</a> or <a href=/v1.14/docs/tasks/observability/metrics/classify-metrics/>request classification</a> to normalize the label.</li></ul></div></div><div class="faq-block faq-block--collapsed" id=mixer-migration><div class=faq-block-question><span class=faq-block-question__text>How do I migrate existing Mixer functionality?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Mixer was <a href=/v1.14/news/releases/1.8.x/announcing-1.8/#deprecations>removed in the 1.8 Istio release</a>.
|
||
Migration is needed if you still rely on Mixer’s built-in adapters or any out-of-process adapters for mesh extension.</p><p>For built-in adapters, several alternatives are provided:</p><ul><li><code>Prometheus</code> and <code>Stackdriver</code> integrations are implemented as <a href=/v1.14/docs/reference/config/proxy_extensions/>proxy extensions</a>.
|
||
Customization of telemetry generated by these two extensions can be achieved via <a href=/v1.14/docs/tasks/observability/metrics/classify-metrics/>request classification</a> and <a href=/v1.14/docs/tasks/observability/metrics/customize-metrics/>Prometheus metrics customization</a>.</li><li>Global and Local Rate-Limiting (<code>memquota</code> and <code>redisquota</code> adapters) functionality is provided through the <a href=/v1.14/docs/tasks/policy-enforcement/rate-limit/>Envoy-based rate-limiting solution</a>.</li><li><code>OPA</code> adapter is replaced by the <a href=/v1.14/docs/tasks/security/authorization/authz-custom/>Envoy ext-authz based solution</a>, which supports <a href=https://www.openpolicyagent.org/docs/latest/envoy-introduction/>integration with OPA policy agent</a>.</li></ul><p>For custom out-of-process adapters, migration to Wasm-based extensions is strongly encouraged. Please refer to the guides on <a href=https://github.com/istio-ecosystem/wasm-extensions/blob/master/doc/write-a-wasm-extension-with-cpp.md>Wasm module development</a> and <a href=/v1.14/docs/tasks/extensibility/wasm-module-distribution/>extension distribution</a>. As a temporary solution, you can <a href=https://github.com/istio/istio/wiki/Enabling-Envoy-Authorization-Service-and-gRPC-Access-Log-Service-With-Mixer>enable Envoy ext-authz and gRPC access log API support in Mixer</a>, which allows you to upgrade Istio to post 1.7 versions while still using 1.7 Mixer with out-of-process adapters. This will give you more time to migrate to Wasm-based extensions. Note this temporary solution is not battle-tested and will unlikely get patch fixes, since it is only available on the Istio 1.7 branch which is out of support window after Feb 2021.</p></div></div><div class="faq-block faq-block--collapsed" id=prometheus-for-non-k8s><div class=faq-block-question><span class=faq-block-question__text>Can the Prometheus adapter be used in non-Kubernetes environments?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>You can use docker-compose to install Prometheus.</p></div></div><div class="faq-block faq-block--collapsed" id=life-of-a-request><div class=faq-block-question><span class=faq-block-question__text>How to figure out what happened to a request in Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>You can enable <a href=/v1.14/docs/tasks/observability/distributed-tracing/>tracing</a> to determine the flow of a request in Istio.</p><p>Additionally, you can use the following commands to know more about the state of the mesh:</p><ul><li><p><a href=/v1.14/docs/reference/commands/istioctl/#istioctl-proxy-config><code>istioctl proxy-config</code></a>: Retrieve information about proxy configuration when running in Kubernetes:</p><pre><code class=language-plain data-expandlinks=true data-repo=istio># Retrieve information about bootstrap configuration for the Envoy instance in the specified pod.
|
||
$ istioctl proxy-config bootstrap productpage-v1-bb8d5cbc7-k7qbm
|
||
|
||
# Retrieve information about cluster configuration for the Envoy instance in the specified pod.
|
||
$ istioctl proxy-config cluster productpage-v1-bb8d5cbc7-k7qbm
|
||
|
||
# Retrieve information about listener configuration for the Envoy instance in the specified pod.
|
||
$ istioctl proxy-config listener productpage-v1-bb8d5cbc7-k7qbm
|
||
|
||
# Retrieve information about route configuration for the Envoy instance in the specified pod.
|
||
$ istioctl proxy-config route productpage-v1-bb8d5cbc7-k7qbm
|
||
|
||
# Retrieve information about endpoint configuration for the Envoy instance in the specified pod.
|
||
$ istioctl proxy-config endpoints productpage-v1-bb8d5cbc7-k7qbm
|
||
|
||
# Try the following to discover more proxy-config commands
|
||
$ istioctl proxy-config --help
|
||
</code></pre></li><li><p><code>kubectl get</code>: Gets information about different resources in the mesh along with routing configuration:</p><pre><code class=language-plain data-expandlinks=true data-repo=istio># List all virtual services
|
||
$ kubectl get virtualservices
|
||
</code></pre></li></ul></div></div><div class="faq-block faq-block--collapsed" id=prometheus-application-metrics><div class=faq-block-question><span class=faq-block-question__text>Can I use Prometheus to scrape application metrics with Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Yes. Istio ships with <a href=https://raw.githubusercontent.com/istio/istio/release-1.14/manifests/charts/istio-telemetry/prometheus/templates/configmap.yaml>configuration for Prometheus</a>
|
||
that enables collection of application metrics when mutual TLS is enabled or disabled.</p><p>The <code>kubernetes-pods</code> job collects application metrics from pods in environments without mutual TLS. The <code>kubernetes-pods-istio-secure</code> job collects metrics
|
||
from application pods when mutual TLS is enabled for Istio.</p><p>Both jobs require that the following annotations are added to any deployments from which application metric collection is desired:</p><ul><li><code>prometheus.io/scrape: "true"</code></li><li><code>prometheus.io/path: "<metrics path>"</code></li><li><code>prometheus.io/port: "<metrics port>"</code></li></ul><p>A few notes:</p><ul><li>If the Prometheus pod started before the Istio Citadel pod could generate the required certificates and distribute them to Prometheus, the Prometheus pod will need to
|
||
be restarted in order to collect from mutual TLS-protected targets.</li><li>If your application exposes Prometheus metrics on a dedicated port, that port should be added to the service and deployment specifications.</li></ul></div></div><h2 id=distributed-tracing>Distributed Tracing</h2><div class="faq-block faq-block--collapsed" id=how-distributed-tracing-works><div class=faq-block-question><span class=faq-block-question__text>How does distributed tracing work with Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio integrates with distributed tracing systems using <a href=#how-envoy-based-tracing-works>Envoy-based</a> tracing. With Envoy-based tracing integration, <a href=#istio-copy-headers>applications are responsible for forwarding tracing headers</a> for subsequent outgoing requests.</p><p>You can find additional information in the Istio Distributed Tracing (<a href=/v1.14/docs/tasks/observability/distributed-tracing/jaeger/>Jaeger</a>, <a href=/v1.14/docs/tasks/observability/distributed-tracing/lightstep/>Lightstep</a>, <a href=/v1.14/docs/tasks/observability/distributed-tracing/zipkin/>Zipkin</a>) Tasks and
|
||
in the <a href=https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/tracing>Envoy tracing docs</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=how-to-support-tracing><div class=faq-block-question><span class=faq-block-question__text>What is required for distributed tracing with Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio enables reporting of trace spans for workload-to-workload communications within a mesh. However, in order for various trace spans to be stitched together for a complete view of the traffic flow, applications must propagate the trace context between incoming and outgoing requests.</p><p>In particular, Istio relies on applications to <a href=https://github.com/openzipkin/b3-propagation>propagate the B3 trace headers</a>, as well as the Envoy-generated request ID. These headers include:</p><ul><li><code>x-request-id</code></li><li><code>x-b3-traceid</code></li><li><code>x-b3-spanid</code></li><li><code>x-b3-parentspanid</code></li><li><code>x-b3-sampled</code></li><li><code>x-b3-flags</code></li><li><code>b3</code></li></ul><p>If you are using Lightstep, you will also need to forward the following headers:</p><ul><li><code>x-ot-span-context</code></li></ul><p>Header propagation may be accomplished through client libraries, such as <a href=https://zipkin.io/pages/tracers_instrumentation.html>Zipkin</a> or <a href=https://github.com/jaegertracing/jaeger-client-java/tree/master/jaeger-core#b3-propagation>Jaeger</a>. It may also be accomplished manually, as documented in the <a href=/v1.14/docs/tasks/observability/distributed-tracing/overview/#trace-context-propagation>Distributed Tracing Task</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=how-envoy-based-tracing-works><div class=faq-block-question><span class=faq-block-question__text>How does Envoy-based tracing work?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>For Envoy-based tracing integrations, Envoy (the sidecar proxy) sends tracing information directly to tracing backends on behalf of the applications being proxied.</p><p>Envoy:</p><ul><li>generates request IDs and trace headers (i.e., <code>X-B3-TraceId</code>) for requests as they flow through the proxy</li><li>generates trace spans for each request based on request and response metadata (i.e., response time)</li><li>sends the generated trace spans to the tracing backends</li><li>forwards the trace headers to the proxied application</li></ul><p>Istio supports the Envoy-based integrations of <a href=/v1.14/docs/tasks/observability/distributed-tracing/lightstep/>Lightstep</a> and <a href=/v1.14/docs/tasks/observability/distributed-tracing/zipkin/>Zipkin</a>, as well as all Zipkin API-compatible backends, including <a href=/v1.14/docs/tasks/observability/distributed-tracing/jaeger/>Jaeger</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=minimal-requirements><div class=faq-block-question><span class=faq-block-question__text>What is the minimal Istio configuration required for distributed tracing?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>The <a href=https://archive.istio.io/1.4/docs/setup/install/helm/>Istio minimal profile</a> with tracing enabled is all that is required for Istio to integrate with Zipkin-compatible backends.</p></div></div><div class="faq-block faq-block--collapsed" id=initial-zipkin-header><div class=faq-block-question><span class=faq-block-question__text>What generates the initial Zipkin (B3) HTTP headers?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>The Istio sidecar proxy (Envoy) generates the initial <a href=https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-request-id>headers</a>, if they are not provided by the request.</p></div></div><div class="faq-block faq-block--collapsed" id=istio-copy-headers><div class=faq-block-question><span class=faq-block-question__text>Why can't Istio propagate headers instead of the application?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Although an Istio sidecar will process both inbound and outbound requests for an associated application instance, it has no implicit way of correlating
|
||
the outbound requests to the inbound request that caused them. The only way this correlation can be achieved is if the application
|
||
propagates relevant information (i.e. headers) from the inbound request to the outbound requests. Header propagation may be accomplished through client
|
||
libraries or manually. Further discussion is provided in <a href=/v1.14/about/faq/#how-to-support-tracing>What is required for distributed tracing with Istio?</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=no-tracing><div class=faq-block-question><span class=faq-block-question__text>Why are my requests not being traced?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Since Istio 1.0.3, the sampling rate for tracing has been reduced to 1% in the <code>default</code>
|
||
<a href=/v1.14/docs/setup/additional-setup/config-profiles/>configuration profile</a>.
|
||
This means that only 1 out of 100 trace instances captured by Istio will be reported to the tracing backend.
|
||
The sampling rate in the <code>demo</code> profile is still set to 100%. See
|
||
<a href=/v1.14/docs/tasks/observability/distributed-tracing/mesh-and-proxy-config/#customizing-trace-sampling>this section</a>
|
||
for more information on how to set the sampling rate.</p><p>If you still do not see any trace data, please confirm that your ports conform to the Istio <a href=/v1.14/about/faq/#naming-port-convention>port naming conventions</a> and that the appropriate container port is exposed (via pod spec, for example) to enable
|
||
traffic capture by the sidecar proxy (Envoy).</p><p>If you only see trace data associated with the egress proxy, but not the ingress proxy, it may still be related to the Istio <a href=/v1.14/about/faq/#naming-port-convention>port naming conventions</a>. Starting with <a href=/v1.14/news/releases/1.3.x/announcing-1.3/#intelligent-protocol-detection-experimental>Istio 1.3</a> the protocol for <strong>outbound</strong> traffic is automatically detected.</p></div></div><div class="faq-block faq-block--collapsed" id=control-sampling><div class=faq-block-question><span class=faq-block-question__text>How can I control the volume of traces?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio, via Envoy, currently supports a percentage-based sampling strategy for trace generation.
|
||
Please see <a href=/v1.14/docs/tasks/observability/distributed-tracing/mesh-and-proxy-config/#customizing-trace-sampling>this section</a> for more information on how to set this sampling rate.</p></div></div><div class="faq-block faq-block--collapsed" id=disabling-tracing><div class=faq-block-question><span class=faq-block-question__text>How do I disable tracing?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>If you already have installed Istio with tracing enabled, you can disable it as follows:</p><pre><code class=language-plain data-expandlinks=true data-repo=istio># Fill <istio namespace> with the namespace of your istio mesh.Ex: istio-system
|
||
TRACING_POD=`kubectl get po -n <istio namespace> | grep istio-tracing | awk '{print $1}'`
|
||
$ kubectl delete pod $TRACING_POD -n <istio namespace>
|
||
$ kubectl delete services tracing zipkin -n <istio namespace>
|
||
# Now, manually remove instances of trace_zipkin_url from the file and save it.
|
||
</code></pre><p>Then follow the steps of the <a href=/v1.14/docs/tasks/observability/distributed-tracing/zipkin/#cleanup>cleanup section of the Distributed Tracing task</a>.</p><p>If you don’t want tracing functionality at all, then <a href=/v1.14/docs/tasks/observability/distributed-tracing/zipkin/#before-you-begin>disable tracing</a> when installing Istio.</p></div></div><div class="faq-block faq-block--collapsed" id=external-zipkin><div class=faq-block-question><span class=faq-block-question__text>Can Istio send tracing information to an external Zipkin-compatible backend?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>To do so, you must you use the fully qualified domain name of the Zipkin-compatible instance. For example:
|
||
<code>zipkin.mynamespace.svc.cluster.local</code>.</p></div></div><div class="faq-block faq-block--collapsed" id=vert.x><div class=faq-block-question><span class=faq-block-question__text>Does Istio support request tracing for vert.x event bus messages?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio does not currently provide support for pub/sub and event bus protocols. Any use of those technologies is best-effort and subject to breakage.</p></div></div><h2 id=traffic-management>Traffic Management</h2><div class="faq-block faq-block--collapsed" id=viewing-current-rules><div class=faq-block-question><span class=faq-block-question__text>How can I view the current route rules I have configured with Istio?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Rules can be viewed using <code>kubectl get virtualservice -o yaml</code></p></div></div><div class="faq-block faq-block--collapsed" id=controlling-inbound-ports><div class=faq-block-question><span class=faq-block-question__text>On what ports does a sidecar proxy capture inbound traffic?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Istio captures inbound traffic on all ports by default.
|
||
You can override this behavior using the <code>traffic.sidecar.istio.io/includeInboundPorts</code> pod annotation
|
||
to specify an explicit list of ports to capture, or using <code>traffic.sidecar.istio.io/excludeOutboundPorts</code>
|
||
to specify a list of ports to bypass.</p></div></div><div class="faq-block faq-block--collapsed" id=difference-between-mutual-and-istio-mutual><div class=faq-block-question><span class=faq-block-question__text>What is the difference between MUTUAL and ISTIO_MUTUAL TLS modes?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Both of these <code>DestinationRule</code> settings will send mutual TLS traffic.
|
||
With <code>ISTIO_MUTUAL</code>, Istio certificates will automatically be used.
|
||
For <code>MUTUAL</code>, the key, certificate, and trusted CA must be configured.
|
||
This allows initiating mutual TLS with non-Istio applications.</p></div></div><div class="faq-block faq-block--collapsed" id=statefulsets><div class=faq-block-question><span class=faq-block-question__text>Can Istio be used with StatefulSets and headless Services?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Yes, Istio fully supports these workloads as of <a href=/v1.14/blog/2021/statefulsets-made-easier/>Istio 1.10</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=ingress-with-no-route-rules><div class=faq-block-question><span class=faq-block-question__text>Can I use standard Ingress specification without any route rules?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Simple ingress specifications, with host, TLS, and exact path based
|
||
matches will work out of the box without the need for route
|
||
rules. However, note that the path used in the ingress resource should
|
||
not have any <code>.</code> characters.</p><p>For example, the following ingress resource matches requests for the
|
||
example.com host, with /helloworld as the URL.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl create -f - <<EOF
|
||
apiVersion: extensions/v1beta1
|
||
kind: Ingress
|
||
metadata:
|
||
name: simple-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: istio
|
||
spec:
|
||
rules:
|
||
- host: example.com
|
||
http:
|
||
paths:
|
||
- path: /helloworld
|
||
backend:
|
||
serviceName: myservice
|
||
servicePort: grpc
|
||
EOF
|
||
</code></pre><p>However, the following rules will not work because they use regular
|
||
expressions in the path and <code>ingress.kubernetes.io</code> annotations:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl create -f - <<EOF
|
||
apiVersion: extensions/v1beta1
|
||
kind: Ingress
|
||
metadata:
|
||
name: this-will-not-work
|
||
annotations:
|
||
kubernetes.io/ingress.class: istio
|
||
# Ingress annotations other than ingress class will not be honored
|
||
ingress.kubernetes.io/rewrite-target: /
|
||
spec:
|
||
rules:
|
||
- host: example.com
|
||
http:
|
||
paths:
|
||
- path: /hello(.*?)world/
|
||
backend:
|
||
serviceName: myservice
|
||
servicePort: grpc
|
||
EOF
|
||
</code></pre></div></div><div class="faq-block faq-block--collapsed" id=cors><div class=faq-block-question><span class=faq-block-question__text>Why is my CORS configuration not working?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>After applying <a href=/v1.14/docs/reference/config/networking/virtual-service/#CorsPolicy>CORS configuration</a>, you may find that seemingly nothing happened and wonder what went wrong.
|
||
CORS is a commonly misunderstood HTTP concept that often leads to confusion when configuring.</p><p>To understand this, it helps to take a step back and look at <a href=https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS>what CORS is</a> and when it should be used.
|
||
By default, browsers have restrictions on “cross origin” requests initiated by scripts.
|
||
This prevents, for example, a website <code>attack.example.com</code> from making a JavaScript request to <code>bank.example.com</code> and stealing a users sensitive information.</p><p>In order to allow this request, <code>bank.example.com</code> must allow <code>attack.example.com</code> to perform cross origin requests.
|
||
This is where CORS comes in. If we were serving <code>bank.example.com</code> in an Istio enabled cluster, we could configure a <code>corsPolicy</code> to allow this:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1beta1
|
||
kind: VirtualService
|
||
metadata:
|
||
name: bank
|
||
spec:
|
||
hosts:
|
||
- bank.example.com
|
||
http:
|
||
- corsPolicy:
|
||
allowOrigins:
|
||
- exact: https://attack.example.com
|
||
...
|
||
</code></pre><p>In this case we explicitly allow a single origin; wildcards are common for non-sensitive pages.</p><p>Once we do this, a common mistake is to send a request like <code>curl bank.example.com -H "Origin: https://attack.example.com"</code>, and expect the request to be rejected.
|
||
However, curl and many other clients will not see a rejected request, because CORS is a browser constraint.
|
||
The CORS configuration simply adds <code>Access-Control-*</code> headers in the response; it is up to the client (browser) to reject the request if the response is not satisfactory.
|
||
In browsers, this is done by a <a href=https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#preflighted_requests>Preflight request</a>.</p></div></div><div class="faq-block faq-block--collapsed" id=naming-port-convention><div class=faq-block-question><span class=faq-block-question__text>What protocols does Istio support?</span><div class=faq-block-question__icon><svg class="icon dropdown-arrow"><use xlink:href="/v1.14/img/icons.svg#dropdown-arrow"/></svg></div></div><div class=faq-block-answer><p>Currently, Istio supports TCP based protocols. Additionally, Istio provides functionality such as routing and metrics for other protocols such as <code>http</code> and <code>mysql</code>.</p><p>For a list of all protocols, and information on how to configure protocols, view the <a href=/v1.14/docs/ops/configuration/traffic-management/protocol-selection/>Protocol Selection</a> documentation.</p></div></div></div></article></div><div class=toc-container><nav class=toc aria-label="Table of Contents"><div id=toc><ol><li role=none aria-label=General><a href=#general>General</a><li role=none aria-label=Setup><a href=#setup>Setup</a><li role=none aria-label=Security><a href=#security>Security</a><li role=none aria-label="Metrics and Logs"><a href=#metrics-and-logs>Metrics and Logs</a><li role=none aria-label="Distributed Tracing"><a href=#distributed-tracing>Distributed Tracing</a><li role=none aria-label="Traffic Management"><a href=#traffic-management>Traffic Management</a></ol></div></nav></div></main><footer class=footer><div class="footer-wrapper container-l"><div class="user-links footer-links"><a class=channel title="GitHub is where development takes place on Istio code" href=https://github.com/istio/community aria-label=GitHub><svg class="icon github"><use xlink:href="/v1.14/img/icons.svg#github"/></svg></a><a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><svg class="icon drive"><use xlink:href="/v1.14/img/icons.svg#drive"/></svg></a><a class=channel title="Interactively discuss issues with the Istio community on Slack" href=https://slack.istio.io aria-label=slack><svg class="icon slack"><use xlink:href="/v1.14/img/icons.svg#slack"/></svg></a><a class=channel title="Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio" href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><svg class="icon stackoverflow"><use xlink:href="/v1.14/img/icons.svg#stackoverflow"/></svg></a><a class=channel title="Follow us on Twitter to get the latest news" href=https://twitter.com/IstioMesh aria-label=Twitter><svg class="icon twitter"><use xlink:href="/v1.14/img/icons.svg#twitter"/></svg></a></div><hr class=footer-separator role=separator><div class="info footer-info"><a class=logo href=/v1.14/ aria-label=logotype><svg xmlns="http://www.w3.org/2000/svg" width="128" height="60" viewBox="0 0 128 60"><path d="M58.434 48.823A.441.441.0 0158.3 48.497V22.583a.444.444.0 01.134-.326.446.446.0 01.327-.134h3.527a.447.447.0 01.325.134.447.447.0 01.134.326v25.914a.443.443.0 01-.134.326.444.444.0 01-.325.134h-3.527a.444.444.0 01-.327-.134z"/><path d="m70.969 48.477a6.556 6.556.0 01-2.818-1.955 4.338 4.338.0 01-1-2.78v-.345a.443.443.0 01.134-.326.444.444.0 01.326-.135h3.374a.444.444.0 01.326.135.445.445.0 01.134.326v.077a2.014 2.014.0 001.054 1.667 4.672 4.672.0 002.664.709 4.446 4.446.0 002.492-.633 1.862 1.862.0 00.958-1.591 1.426 1.426.0 00-.786-1.322 12.7 12.7.0 00-2.549-.939l-1.457-.46a21.526 21.526.0 01-3.3-1.227 6.57 6.57.0 01-2.262-1.783 4.435 4.435.0 01-.92-2.894 5.081 5.081.0 012.109-4.275 8.993 8.993.0 015.558-1.591 10.445 10.445.0 014.1.748 6.3 6.3.0 012.722 2.07 5 5 0 01.958 3.009.441.441.0 01-.134.326.441.441.0 01-.325.134h-3.258a.441.441.0 01-.326-.134.443.443.0 01-.134-.326 1.974 1.974.0 00-.978-1.667 4.647 4.647.0 00-2.665-.671 4.741 4.741.0 00-2.435.556 1.724 1.724.0 00-.938 1.553 1.512 1.512.0 00.9 1.4 15.875 15.875.0 003.01 1.055l.843.229a27.368 27.368.0 013.412 1.246 6.67 6.67.0 012.338 1.763 4.387 4.387.0 01.958 2.933 4.988 4.988.0 01-2.146 4.275 9.543 9.543.0 01-5.712 1.552 11.626 11.626.0 01-4.227-.709z"/><path d="m97.039 32.837a.443.443.0 01-.326.135h-3.911a.169.169.0 00-.191.192v9.239a2.951 2.951.0 00.632 2.108 2.7 2.7.0 002.013.652h1.15a.444.444.0 01.325.134.441.441.0 01.134.326v2.875a.471.471.0 01-.459.5l-1.994.039a8 8 0 01-4.524-1.035q-1.495-1.035-1.533-3.91V33.166A.17.17.0 0088.164 32.974H85.978A.441.441.0 0185.652 32.839.441.441.0 0185.518 32.513V29.83a.441.441.0 01.134-.326.444.444.0 01.326-.135h2.186a.169.169.0 00.191-.192v-4.485a.438.438.0 01.134-.326.44.44.0 01.325-.134h3.336a.443.443.0 01.325.134.442.442.0 01.135.326v4.485a.169.169.0 00.191.192h3.911a.446.446.0 01.326.135.446.446.0 01.134.326v2.683a.446.446.0 01-.133.324z"/><path d="m101.694 25.917a2.645 2.645.0 01-.767-1.955 2.65 2.65.0 01.767-1.955 2.65 2.65.0 011.955-.767 2.65 2.65.0 011.955.767 2.652 2.652.0 01.767 1.955 2.647 2.647.0 01-.767 1.955 2.646 2.646.0 01-1.955.767 2.645 2.645.0 01-1.955-.767zm-.211 22.906a.441.441.0 01-.134-.326V29.79a.444.444.0 01.134-.326.446.446.0 01.326-.134h3.527a.446.446.0 01.326.134.445.445.0 01.134.326v18.707a.443.443.0 01-.134.326.443.443.0 01-.326.134h-3.527a.443.443.0 01-.326-.134z"/><path d="m114.019 47.734a8.1 8.1.0 01-3.047-4.255 14.439 14.439.0 01-.652-4.37 14.3 14.3.0 01.614-4.371A7.869 7.869.0 01114 30.56a9.072 9.072.0 015.252-1.5 8.543 8.543.0 015.041 1.5 7.985 7.985.0 013.009 4.14 12.439 12.439.0 01.69 4.37 13.793 13.793.0 01-.651 4.37 8.255 8.255.0 01-3.028 4.275 8.475 8.475.0 01-5.1 1.553 8.754 8.754.0 01-5.194-1.534zm7.629-3.1a4.536 4.536.0 001.476-2.262 11.335 11.335.0 00.383-3.221 10.618 10.618.0 00-.383-3.22 4.169 4.169.0 00-1.457-2.243 4.066 4.066.0 00-2.531-.785 3.942 3.942.0 00-2.453.785 4.376 4.376.0 00-1.5 2.243 11.839 11.839.0 00-.383 3.22 11.84 11.84.0 00.383 3.221 4.222 4.222.0 001.476 2.262 4.075 4.075.0 002.549.8 3.8 3.8.0 002.44-.809z"/><path d="m15.105 32.057v15.565a.059.059.0 01-.049.059L.069 50.25A.06.06.0 01.005 50.167l14.987-33.47a.06.06.0 01.114.025z"/><path d="m17.631 23.087v24.6a.06.06.0 00.053.059l22.449 2.507a.06.06.0 00.061-.084L17.745.032a.06.06.0 00-.114.024z"/><path d="m39.961 52.548-24.833 7.45a.062.062.0 01-.043.0L.079 52.548a.059.059.0 01.026-.113h39.839a.06.06.0 01.017.113z"/></svg></a><div class=footer-languages><a tabindex=-1 lang=en id=switch-lang-en class="footer-languages-item active"><svg class="icon tick"><use xlink:href="/v1.14/img/icons.svg#tick"/></svg>English</a>
|
||
<a tabindex=-1 lang=zh id=switch-lang-zh class=footer-languages-item>中文</a></div></div><ul class=footer-policies><li class=footer-policies-item><a class=footer-policies-link href=https://policies.google.com/privacy>Privacy policy</a> |
|
||
<a class=footer-policies-link href=https://github.com/istio/istio.io/edit/release-1.14/content/en/about/faq/_index.md>Edit this Page on GitHub</a></li></ul><div class=footer-base><span class=footer-base-copyright>© 2022 Istio Authors.</span>
|
||
<span class=footer-base-version>Version
|
||
Archive
|
||
1.14.3</span><ul class=footer-base-releases><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link onclick='return navigateToUrlOrRoot("https://istio.io/about/faq/"),!1'>current release</a></li><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link onclick='return navigateToUrlOrRoot("https://preliminary.istio.io/about/faq/"),!1'>next release</a></li><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link href=https://istio.io/archive>older releases</a></li></ul></div></div></footer><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title="Back to top" tabindex=-1><svg class="icon top"><use xlink:href="/v1.14/img/icons.svg#top"/></svg></button></div></body></html> |