Implementing Service Mesh
1. Understanding Service Mesh Concepts
| Component | Role |
|---|
| Data plane | Sidecar proxies (Envoy, linkerd-proxy) |
| Control plane | Configure proxies, manage certs |
| Ambient mode | Sidecar-less (Istio ambient, Cilium Service Mesh) |
2. Installing Istio
istioctl install --set profile=demo -y
kubectl label namespace prod istio-injection=enabled
| Profile | Use |
|---|
| default | Production baseline |
| demo | All addons enabled |
| ambient NEW | Sidecar-less data plane |
3. Installing Linkerd
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -
linkerd check
4. Enabling Sidecar Injection
kubectl label ns prod istio-injection=enabled # Istio
kubectl annotate ns prod linkerd.io/inject=enabled # Linkerd
5. Configuring Traffic Management
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: { name: web }
spec:
hosts: [web]
http:
- route:
- { destination: { host: web, subset: v1 }, weight: 90 }
- { destination: { host: web, subset: v2 }, weight: 10 }
6. Implementing mTLS
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: { name: default, namespace: prod }
spec:
mtls: { mode: STRICT }
| mode | Behavior |
|---|
| DISABLE | Plain TCP |
| PERMISSIVE | Both mTLS & plain |
| STRICT | Only mTLS |
7. Configuring Request Routing
http:
- match:
- headers: { x-canary: { exact: "true" } }
route: [{ destination: { host: web, subset: canary } }]
- route: [{ destination: { host: web, subset: stable } }]
8. Implementing Circuit Breaking
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: web }
spec:
host: web
trafficPolicy:
connectionPool:
tcp: { maxConnections: 100 }
http: { http1MaxPendingRequests: 50, maxRequestsPerConnection: 10 }
outlierDetection:
consecutive5xxErrors: 5
interval: 30s
baseEjectionTime: 1m
9. Observing Service Mesh
istioctl dashboard kiali
istioctl dashboard grafana
istioctl proxy-status
10. Troubleshooting Service Mesh
| Symptom | Cause |
|---|
| 503 UC | Upstream connect; backend not ready |
| 503 NR | No route configured |
| mTLS errors | Mismatched PeerAuthentication mode |
| Sidecar absent | Namespace not labeled |