Istio Traffic Management

Comprehensive guide to Istio traffic management for production service mesh deployments.

When to Use This Skill

• Configuring service-to-service routing

• Implementing canary or blue-green deployments

• Setting up circuit breakers and retries

• Load balancing configuration

• Traffic mirroring for testing

• Fault injection for chaos engineering

Core Concepts

1. Traffic Management Resources

Resource Purpose Scope

VirtualService Route traffic to destinations Host-based

DestinationRule Define policies after routing Service-based

Gateway Configure ingress/egress Cluster edge

ServiceEntry Add external services Mesh-wide

2. Traffic Flow

Client → Gateway → VirtualService → DestinationRule → Service (routing) (policies) (pods)

Templates

Template 1: Basic Routing

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: reviews-route namespace: bookinfo spec: hosts: - reviews http: - match: - headers: end-user: exact: jason route: - destination: host: reviews subset: v2 - route: - destination: host: reviews subset: v1

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: reviews-destination namespace: bookinfo spec: host: reviews subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2 - name: v3 labels: version: v3

Template 2: Canary Deployment

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: my-service-canary spec: hosts: - my-service http: - route: - destination: host: my-service subset: stable weight: 90 - destination: host: my-service subset: canary weight: 10

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: my-service-dr spec: host: my-service trafficPolicy: connectionPool: tcp: maxConnections: 100 http: h2UpgradePolicy: UPGRADE http1MaxPendingRequests: 100 http2MaxRequests: 1000 subsets: - name: stable labels: version: stable - name: canary labels: version: canary

Template 3: Circuit Breaker

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: circuit-breaker spec: host: my-service trafficPolicy: connectionPool: tcp: maxConnections: 100 http: http1MaxPendingRequests: 100 http2MaxRequests: 1000 maxRequestsPerConnection: 10 maxRetries: 3 outlierDetection: consecutive5xxErrors: 5 interval: 30s baseEjectionTime: 30s maxEjectionPercent: 50 minHealthPercent: 30

Template 4: Retry and Timeout

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: ratings-retry spec: hosts: - ratings http: - route: - destination: host: ratings timeout: 10s retries: attempts: 3 perTryTimeout: 3s retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503 retryRemoteLocalities: true

Template 5: Traffic Mirroring

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: mirror-traffic spec: hosts: - my-service http: - route: - destination: host: my-service subset: v1 mirror: host: my-service subset: v2 mirrorPercentage: value: 100.0

Template 6: Fault Injection

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: fault-injection spec: hosts: - ratings http: - fault: delay: percentage: value: 10 fixedDelay: 5s abort: percentage: value: 5 httpStatus: 503 route: - destination: host: ratings

Template 7: Ingress Gateway

apiVersion: networking.istio.io/v1beta1 kind: Gateway metadata: name: my-gateway spec: selector: istio: ingressgateway servers: - port: number: 443 name: https protocol: HTTPS tls: mode: SIMPLE credentialName: my-tls-secret hosts: - "*.example.com"

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: my-vs spec: hosts: - "api.example.com" gateways: - my-gateway http: - match: - uri: prefix: /api/v1 route: - destination: host: api-service port: number: 8080

Load Balancing Strategies

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: load-balancing spec: host: my-service trafficPolicy: loadBalancer: simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH

Consistent hashing for sticky sessions

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: sticky-sessions spec: host: my-service trafficPolicy: loadBalancer: consistentHash: httpHeaderName: x-user-id # or: httpCookie, useSourceIp, httpQueryParameterName

Best Practices

Do's

• Start simple - Add complexity incrementally

• Use subsets - Version your services clearly

• Set timeouts - Always configure reasonable timeouts

• Enable retries - But with backoff and limits

• Monitor - Use Kiali and Jaeger for visibility

Don'ts

• Don't over-retry - Can cause cascading failures

• Don't ignore outlier detection - Enable circuit breakers

• Don't mirror to production - Mirror to test environments

• Don't skip canary - Test with small traffic percentage first

Debugging Commands

Check VirtualService configuration

istioctl analyze

View effective routes

istioctl proxy-config routes deploy/my-app -o json

Check endpoint discovery

istioctl proxy-config endpoints deploy/my-app

Debug traffic

istioctl proxy-config log deploy/my-app --level debug