Exploring Istio

According to the Istio official website, Istio is an open source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio is the path to load balancing, service-to-service authentication, and monitoring – with few or no service code changes.

To get a better understanding of what Istio is capable of we are going to take a look at some of its features using a demo application.

Source: https://istio.io/latest/about/service-mesh/

Application overview

Within the microshop namespace, we have the different components of our application. It consists of 3 microservices: a log service, a user service and a product service that is deployed on 2 different pods. Notice the Istio-proxy container in each Pod which indicates that Istio utilizes the sidecar pattern. In this pattern, each microservice is paired with a separate, lightweight proxy (the “sidecar”) that handles communication, monitoring, and security tasks alongside the main application, ensuring efficient and uniform management of microservice interactions.

The purple elements you can see on the diagram are Istio specific components, we have an ingress gateway who handles all the incoming traffic from the outside world and then we have the VirtualServices who handle the traffic to the different (micro)services it self. This is also the place where you can implement features like traffic shifting (canary deployments, blue-green deployments, circuit-breaking, etc.) and traffic mirroring.

Traffic shifting

Example of distributing 50% of traffic to Products V1 and 50% to Products V2:

On the other hand, we have the istio-system namespace. Here you can find different components that come with Istio to manage your service mesh, including Kiali for visualising your mesh, Jaeger for tracing and monitoring your microservice applications and Prometheus for performance related dashboards.

These can be accessed using the istioctl command line interface.

istioctl dashboard kiali

istioctl dashboard Jaeger

istioctl dashboard Prometheus

Client credential flow

We also implemented a client credential flow that acts as a shield for specific types of requests. In this demo we used Auth0 as our trusted token issuer.

With this setup, we’ve allowed GET requests to the user and product services and simultaneously blocked all other unauthorized requests, again with minimal configuration within Istio.

mTLS for interservice communication

Another feature we want to demonstrate is the implementation of mTLS between the different services. We will provide you with a snippet to accomplish this using a default policy for your applications and a screenshot from Kiali to visualise this.