Service Mesh — Deep Dive

graph TD
    subgraph Control Plane
        CP[Istiod]
    end
    subgraph Data Plane
        subgraph Pod A
            A[App A]
            EA[Envoy]
        end
        subgraph Pod B
            B[App B]
            EB[Envoy]
        end
    end
    CP -->|Config| EA
    CP -->|Config| EB
    A --> EA
    EA -->|mTLS| EB
    EB --> B

graph TD
    subgraph Control Plane
        I[Istiod]
        I --> CA[Certificate Authority]
        I --> C[Config Management]
        I --> D[Discovery]
    end
    subgraph Data Plane
        E1[Envoy]
        E2[Envoy]
        E3[Envoy]
    end
    I -->|xDS| E1
    I -->|xDS| E2
    I -->|xDS| E3
    E1 <-->|mTLS| E2
    E2 <-->|mTLS| E3

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: orders
spec:
  hosts:
    - order-service
  http:
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: order-service
            subset: v2
    - route:
        - destination:
            host: order-service
            subset: v1
          weight: 90
        - destination:
            host: order-service
            subset: v2
          weight: 10

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: orders
spec:
  host: order-service
  trafficPolicy:
    connectionPool:
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 100
    loadBalancer:
      simple: LEAST_CONN
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 60s
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

trafficPolicy:
  outlierDetection:
    consecutive5xxErrors: 5
    interval: 10s
    baseEjectionTime: 30s
    maxEjectionPercent: 50

http:
  - route:
      - destination:
          host: order-service
    retries:
      attempts: 3
      perTryTimeout: 2s
      retryOn: 5xx,reset,connect-failure

http:
  - route:
      - destination:
          host: order-service
    timeout: 10s

sequenceDiagram
    participant A as Service A
    participant EA as Envoy A
    participant EB as Envoy B
    participant B as Service B

    A->>EA: HTTP request
    EA->>EB: mTLS encrypted
    EB->>B: HTTP request
    B->>EB: Response
    EB->>EA: mTLS encrypted
    EA->>A: Response

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # Require mTLS for all services

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: order-service-policy
spec:
  selector:
    matchLabels:
      app: order-service
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/production/sa/payment-service"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/orders/*"]

# Istio exports these automatically
istio_requests_total{...}
istio_request_duration_milliseconds{...}
istio_tcp_connections_opened_total{...}

graph LR
    A[Service A] -->|span| B[Service B]
    B -->|span| C[Service C]
    A -->|trace| J[Jaeger]
    B -->|trace| J
    C -->|trace| J

{
  "protocol": "HTTP/2",
  "upstream_service": "order-service",
  "response_code": 200,
  "response_flags": "-",
  "duration": 45,
  "request_id": "abc-123"
}