[
{
  "id": "architecture",
  "title": "Architecture",
  "url": "/architecture",
  "category": "Concepts",
  "keywords": null,
  "content_html": "<h2 id=\"intro\">Intro</h2>\n\n<h2 id=\"architecture\">Architecture</h2>\n\n<h3 id=\"istio-architecture\">Istio Architecture</h3>\n\n<p>Istio control plane is a single process -  <code>istiod</code>, which contains three components Pilot, Citadel and Galley. You can bring containers in Kubernetes and virtual machines into the Istio mesh together.</p>\n\n<p><img src=\"/img/istio-arch.svg\" alt=\"Istio architecture\" data-img=\"img/istio-arch.svg\" /></p>\n\n<h3 id=\"components\">Components</h3>\n\n<p>The following figure show the components in Istio mesh.</p>\n\n<p><img src=\"/img/istio-components.svg\" alt=\"Istio components\" data-img=\"img/istio-components.svg\" /></p>\n\n<h3 id=\"transparent-traffic-hijacking\">Transparent Traffic Hijacking</h3>\n\n<p>The following figure shows the transparent traffic hijacking and traffic routing in Istio.</p>\n\n<p><img src=\"/img/transparent-traffic-hijacking.svg\" alt=\"Transparent traffic hijacking\" data-img=\"img/transparent-traffic-hijacking.svg\" /></p>\n\n<p><strong>Note</strong></p>\n\n<ul>\n  <li>Only TCP traffic is shown in the figure. Traffic for UDP and other protocols will not be hijacked.</li>\n  <li>It is based on Istio 1.14.</li>\n  <li>It shows the traffic routing in <code>reviews</code> pod of the <a href=\"https://istio.io/latest/docs/examples/bookinfo/\">Bookinfo</a> sample.</li>\n</ul>\n\n<h3 id=\"data-plane\">Data Plane</h3>\n\n<p><a href=\"https://envoyproxy.io\">Envoy</a> is the default sidecar proxy in Istio.</p>\n\n<p><img src=\"/img/envoy-arch.svg\" alt=\"Envoy architecture\" data-img=\"img/envoy-arch.svg\" /></p>\n\n<p>See <a href=\"#envoy\">Envoy section</a>.</p>\n\n<h2 id=\"envoy\">Envoy</h2>\n\n<h3 id=\"xds\">xDS</h3>\n\n<p>Istiod distributes the proxy configurations to Envoy via <a href=\"https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol\">xDS</a> protocol.</p>\n\n<p><img src=\"/img/xds.svg\" alt=\"xDS\" data-img=\"img/xds.svg\" /></p>",
  "intro_html": "<p>Istio concepts.</p>",
  "description_html": "",
  "tags": ["Featured"],
  "updated": "2022-08-04"
},{
  "id": "istioctl",
  "title": "istioctl",
  "url": "/istioctl",
  "category": "CLI",
  "keywords": null,
  "content_html": "<h2 id=\"intro\">Intro</h2>\n\n<h2 id=\"istioctl-overview\">Istioctl Overview</h2>\n\n<h3 id=\"usage\">Usage</h3>\n\n<p><a href=\"https://istio.io/latest/docs/reference/commands/istioctl\"><code>istioctl</code></a> command line usage overview.</p>\n\n<p><img src=\"/img/istioctl.svg\" alt=\"istioctl cheatsheet\" data-img=\"img/istioctl.svg\" /></p>\n\n<h3 id=\"experimentalx\">experimental/x</h3>\n\n<p>Experimental commands that may be modified or deprecated.</p>\n\n<p><img src=\"/img/istioctl-x.svg\" alt=\"istioctl-x\" data-img=\"img/istioctl-x.svg\" /></p>\n\n<p>See <a href=\"https://istio.io/latest/docs/reference/commands/istioctl/#istioctl-experimental\">Istio docs</a> for details.</p>\n\n<h2 id=\"dashboarddashd\">dashboard/dash/d</h2>\n\n<h3 id=\"controlz\">controlz</h3>\n\n<p>Open the ControlZ web UI for a pod in the Istio control plane.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard controlz [&lt;type&gt;/]&lt;name&gt;[.&lt;namespace&gt;] [flags]\n</code></pre>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d controlz istiod-6bc78ccdb-sgdgh -n istio-system\n</code></pre>\n\n<p>You will see the ControlZ UI at <a href=\"http://localhost:9876\">http://localhost:9876</a>.</p>\n\n<h3 id=\"envoy\">envoy</h3>\n\n<p>Open the Envoy admin dashboard for a sidecar.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard envoy [&lt;type&gt;/]&lt;name&gt;[.&lt;namespace&gt;] [flags]\n</code></pre>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d envoy details-v1-7d88846999-ptz54 -n default\n</code></pre>\n\n<p>You can see the UI at <a href=\"http://localhost:15000/\">http://localhost:15000/</a>.</p>\n\n<h3 id=\"grafana\">grafana</h3>\n\n<p>Open Istio’s Grafana dashboard.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard grafana [flags]\n</code></pre>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d grafana\n</code></pre>\n\n<p>You can see the Grafana UI at <a href=\"http://localhost:3000\">http://localhost:3000</a>.</p>\n\n<h3 id=\"jaeger\">jaeger</h3>\n\n<p>Open Istio’s Jaeger dashboard.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard jaeger [flags]\n</code></pre>\n\n<p>Jaeger is not installed by default, run the following command to install Jaeger.</p>\n\n<pre><code class=\"language-bash\">kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/jaeger.yaml\n</code></pre>\n\n<p>See <a href=\"https://istio.io/latest/docs/ops/integrations/jaeger/#installation\">Istio docs</a> for details.</p>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d jaeger\n</code></pre>\n\n<p>you can see the Jaeger UI at <a href=\"http://localhost:16686\">http://localhost:16686</a>.</p>\n\n<h3 id=\"kiali\">kiali</h3>\n\n<p>Open Istio’s Kiali dashboard.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard kiali [flags]\n</code></pre>\n\n<p>Kiali is not installed by default, run the following command to install Kiali.</p>\n\n<pre><code class=\"language-bash\">kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/kiali.yaml\n</code></pre>\n\n<p>See <a href=\"https://istio.io/latest/docs/ops/integrations/kiali/#installation\">Istio docs</a> for details.</p>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d kiali\n</code></pre>\n\n<p>You can see the Kiali UI at <a href=\"http://localhost:20001/kiali\">http://localhost:20001/kiali</a>.</p>\n\n<h3 id=\"prometheus\">prometheus</h3>\n\n<p>Open Istio’s Prometheus dashboard.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard prometheus [flags]\n</code></pre>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d prometheus\n</code></pre>\n\n<p>See the Prometheus UI at <a href=\"http://localhost:9090\">http://localhost:9090</a>.</p>\n\n<h3 id=\"skywalking\">skywalking</h3>\n\n<p>Open the Istio dashboard in the SkyWalking UI.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard skywalking [flags]\n</code></pre>\n\n<p>SkyWalking is not installed by default, refer to the <a href=\"https://skywalking.apache.org/docs/main/latest/en/setup/istio/readme/\">SkyWalking docs</a> to see how to install.</p>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d skywalking\n</code></pre>\n\n<h3 id=\"zipkin\">zipkin</h3>\n\n<p>Open Istio’s Zipkin dashboard.</p>\n\n<pre><code class=\"language-bash\">istioctl dashboard zipkin [flags]\n</code></pre>\n\n<p>Zipkin is not installed by default, run the following command to install Zipkin.</p>\n\n<pre><code class=\"language-bash\">kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/extras/zipkin.yaml\n</code></pre>\n\n<p>See <a href=\"https://istio.io/latest/docs/ops/integrations/zipkin/#installation\">Istio docs</a> for details.</p>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\">istioctl d zipkin\n</code></pre>\n\n<p>You can see the Zipkin UI at <a href=\"http://localhost:9411\">http://localhost:9411</a>.</p>\n\n<h2 id=\"frequently-used-commands\">Frequently Used Commands</h2>\n\n<h3 id=\"install\">install</h3>\n\n<p>The <code>install</code> command generates an Istio install manifest and applies it to a cluster.</p>\n\n<p>Example</p>\n\n<pre><code class=\"language-bash\"># Apply a default Istio installation\nistioctl install\n\n# Enable Tracing\nistioctl install --set meshConfig.enableTracing=true\n\n# Generate the demo profile and don't wait for confirmation\nistioctl install --set profile=demo --skip-confirmation\n\n# To override a setting that includes dots, escape them with a backslash (\\).  Your shell may require enclosing quotes.\nistioctl install --set \"values.sidecarInjectorWebhook.injectedAnnotations.container\\.apparmor\\.security\\.beta\\.kubernetes\\.io/istio-proxy=runtime/default\"\n\n# For setting boolean-string option, it should be enclosed quotes and escaped with a backslash (\\).\nistioctl install --set meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_VIA_AGENT=\\\"false\\\"\n</code></pre>\n\n<h3 id=\"manifest\">manifest</h3>\n\n<p>The manifest command generates and diffs Istio manifests.</p>\n\n<p><strong>istioctl manifest install</strong></p>\n\n<pre><code class=\"language-bash\"># Apply a default Istio installation\nistioctl install\n\n# Enable Tracing\nistioctl install --set meshConfig.enableTracing=true\n\n# Generate the demo profile and don't wait for confirmation\nistioctl install --set profile=demo --skip-confirmation\n\n# To override a setting that includes dots, escape them with a backslash (\\).  Your shell may require enclosing quotes.\nistioctl install --set \"values.sidecarInjectorWebhook.injectedAnnotations.container\\.apparmor\\.security\\.beta\\.kubernetes\\.io/istio-proxy=runtime/default\"\n\n# For setting boolean-string option, it should be enclosed quotes and escaped with a backslash (\\).\nistioctl install --set meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_VIA_AGENT=\\\"false\\\"\n</code></pre>\n\n<p><strong>istioctl manifest generate</strong></p>\n\n<pre><code class=\"language-bash\"># Generate a default Istio installation\nistioctl manifest generate\n\n# Enable Tracing\nistioctl manifest generate --set meshConfig.enableTracing=true\n\n# Generate the demo profile\nistioctl manifest generate --set profile=demo\n\n# To override a setting that includes dots, escape them with a backslash (\\).  Your shell may require enclosing quotes.\nistioctl manifest generate --set \"values.sidecarInjectorWebhook.injectedAnnotations.container\\.apparmor\\.security\\.beta\\.kubernetes\\.io/istio-proxy=runtime/default\"\n\n# For setting boolean-string option, it should be enclosed quotes and escaped with a backslash (\\).\nistioctl manifest generate --set meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_VIA_AGENT=\\\"false\\\"\n</code></pre>\n\n<h3 id=\"proxy-configpc\">proxy-config/pc</h3>\n\n<p>A group of commands used to retrieve information about proxy configuration from the Envoy config dump.</p>\n\n<pre><code class=\"language-bash\"># Retrieve information about proxy configuration from an Envoy instance.\nistioctl proxy-config &lt;clusters|listeners|routes|endpoints|bootstrap|log|secret&gt; &lt;pod-name[.namespace]&gt;\n</code></pre>\n\n<p><strong>Example</strong></p>\n\n<pre><code class=\"language-bash\"># Retrieve cluster summary.\nistioctl pc all\n\n# Show a human-readable Istio and Envoy version summary.\nistioctl pc b reviews-v1-55b668fc65-9twc9 -o short\n\n# Retrieve summary about cluster configuration for a given pod from Envoy.\n\nistioctl pc c reviews-v1-55b668fc65-9twc9\n\n# Retrieve full endpoint configuration for a given pod from Envoy.\nistioctl pc ep reviews-v1-55b668fc65-9twc9\n\n# Retrieve summary about listener configuration for a given pod from Envoy.\nistioctl pc l reviews-v1-55b668fc65-9twc9\n\n# Retrieve summary about route configuration for a given pod from Envoy.\nistioctl pc r reviews-v1-55b668fc65-9twc9\n</code></pre>\n\n<h3 id=\"proxy-statusps\">proxy-status/ps</h3>\n\n<p>Retrieves last sent and last acknowledged xDS sync from Istiod to each Envoy in the mesh.</p>\n\n<p><strong>Examples</strong></p>\n\n<pre><code class=\"language-bash\"># Retrieve sync status for all Envoys in a mesh\nistioctl proxy-status\n\n# Retrieve sync diff for a single Envoy and Istiod\nistioctl proxy-status istio-egressgateway-59585c5b9c-ndc59.istio-system\n\n# Retrieve sync diff between Istiod and one pod under a deployment\nistioctl proxy-status deployment/productpage-v1\n\n# Write proxy config-dump to file, and compare to Istio control plane\nkubectl port-forward -n istio-system istio-egressgateway-59585c5b9c-ndc59 15000 &amp;\ncurl localhost:15000/config_dump &gt; cd.json\nistioctl proxy-status istio-egressgateway-59585c5b9c-ndc59.istio-system --file cd.json\n</code></pre>",
  "intro_html": "<p>Istio command line cheatsheet.</p>",
  "description_html": "",
  "tags": ["Featured"],
  "updated": "2022-08-05"
},{
  "id": "observability",
  "title": "Observability",
  "url": "/observability",
  "category": "Concepts",
  "keywords": null,
  "content_html": "<h2 id=\"intro\">Intro</h2>\n\n<h2 id=\"metrics\">Metrics</h2>\n\n<h3 id=\"prometheus\">Prometheus</h3>\n\n<p>The following figure shows the architecture of Prometheus.</p>\n\n<p><img src=\"/img/prometheus-arch.svg\" alt=\"Prometheus architecture\" data-img=\"img/prometheus-arch.svg\" /></p>\n\n<h4 id=\"data-model\"><a href=\"https://prometheus.io/docs/concepts/data_model/\">Data model</a></h4>\n\n<pre><code>&lt;metric name&gt;{&lt;label name&gt;=&lt;label value&gt;, ...} value\n</code></pre>\n\n<p>Example</p>\n\n<pre><code>api_http_requests_total{method=\"POST\", handler=\"/messages\"} 300\n</code></pre>\n\n<h4 id=\"metric-types\"><a href=\"https://prometheus.io/docs/concepts/metric_types/\">Metric types</a></h4>\n\n<table class=\"-headers\">\n  <thead>\n    <tr>\n      <th>Types</th>\n      <th>Description</th>\n      <th>Example</th>\n    </tr>\n  </thead>\n  <tbody>\n    <tr>\n      <td>Counters</td>\n      <td>A <em>counter</em> is a cumulative metric that represents a single monotonically increasing counter whose value can only increase or be reset to zero on restart.</td>\n      <td>Total requests</td>\n    </tr>\n    <tr>\n      <td>Gauges</td>\n      <td>A <em>gauge</em> is a metric that represents a single numerical value that can arbitrarily go up and down.</td>\n      <td>Current active requests</td>\n    </tr>\n    <tr>\n      <td>Histograms</td>\n      <td>A <em>histogram</em> samples observations (usually things like request durations or response sizes) and counts them in configurable buckets. It also provides a sum of all observed values.</td>\n      <td>Upstream request time</td>\n    </tr>\n  </tbody>\n</table>\n\n<h4 id=\"targets\">Targets</h4>\n\n<ul>\n  <li>kuberentes-apiservers</li>\n  <li>kubernetes-nodes</li>\n  <li>kubernetes-nodes-cadvisor</li>\n  <li>kubernetes-pods</li>\n  <li>kubernetes-service-endpoints</li>\n  <li>prometheus</li>\n</ul>\n\n<h3 id=\"istio-standard-metrics\">Istio Standard Metrics</h3>\n\n<table class=\"-headers\">\n  <thead>\n    <tr>\n      <th>Protocol</th>\n      <th>Name</th>\n      <th>Type</th>\n    </tr>\n  </thead>\n  <tbody>\n    <tr>\n      <td>HTTP/HTTP2/gRPC</td>\n      <td><code>istio_requests_total</code></td>\n      <td>counter</td>\n    </tr>\n    <tr>\n      <td>HTTP/HTTP2/gRPC</td>\n      <td><code>istio_request_duration_milliseconds</code></td>\n      <td>histogram</td>\n    </tr>\n    <tr>\n      <td>HTTP/HTTP2/gRPC</td>\n      <td><code>istio_request_bytes</code></td>\n      <td>histogram</td>\n    </tr>\n    <tr>\n      <td>HTTP/HTTP2/gRPC</td>\n      <td><code>istio_response_bytes</code></td>\n      <td>histogram</td>\n    </tr>\n    <tr>\n      <td>HTTP/HTTP2/gRPC</td>\n      <td><code>istio_request_messages_total</code></td>\n      <td>counter</td>\n    </tr>\n    <tr>\n      <td>HTTP/HTTP2/gRPC</td>\n      <td><code>istio_response_messages_total</code></td>\n      <td>counter</td>\n    </tr>\n    <tr>\n      <td>TCP</td>\n      <td><code>istio_tcp_sent_bytes_total</code></td>\n      <td>counter</td>\n    </tr>\n    <tr>\n      <td>TCP</td>\n      <td><code>istio_tcp_received_bytes_total</code></td>\n      <td>counter</td>\n    </tr>\n    <tr>\n      <td>TCP</td>\n      <td><code>istio_tcp_connections_opened_total</code></td>\n      <td>counter</td>\n    </tr>\n    <tr>\n      <td>TCP</td>\n      <td><code>istio_tcp_connections_closed_total</code></td>\n      <td>counter</td>\n    </tr>\n  </tbody>\n</table>\n\n<p>Visit <a href=\"https://istio.io/latest/docs/reference/config/metrics/\">istio.io</a> for details.</p>",
  "intro_html": "<p>Cheatsheet for observability (Metrics, Tracing and Logging) in Istio.</p>",
  "description_html": "",
  "tags": ["Featured"],
  "updated": "2022-08-03"
},{
  "id": "setup",
  "title": "Setup",
  "url": "/setup",
  "category": "Others",
  "keywords": null,
  "content_html": "<h2 id=\"intro\">Intro</h2>\n\n<h2 id=\"basic\">Basic</h2>\n\n<h3 id=\"supported-kubernetes-version\">Supported Kubernetes version</h3>\n\n<table class=\"-headers\">\n  <thead>\n    <tr>\n      <th>Version</th>\n      <th>Currently Supported</th>\n      <th>Supported Kubernetes Versions</th>\n      <th>Tested, but not supported</th>\n    </tr>\n  </thead>\n  <tbody>\n    <tr>\n      <td>1.15</td>\n      <td>Yes</td>\n      <td>1.22, 1.23, 1.24, 1.25</td>\n      <td>1.16, 1.17, 1.18, 1.19, 1.20, 1.21</td>\n    </tr>\n    <tr>\n      <td>1.14</td>\n      <td>Yes</td>\n      <td>1.21, 1.22, 1.23, 1.24</td>\n      <td>1.16, 1.17, 1.18, 1.19, 1.20</td>\n    </tr>\n    <tr>\n      <td>1.13</td>\n      <td>Yes</td>\n      <td>1.20, 1.21, 1.22, 1.23</td>\n      <td>1.16, 1.17, 1.18, 1.19</td>\n    </tr>\n    <tr>\n      <td>1.12</td>\n      <td>Yes</td>\n      <td>1.19, 1.20, 1.21, 1.22</td>\n      <td>1.16, 1.17, 1.18</td>\n    </tr>\n    <tr>\n      <td>1.11</td>\n      <td>Yes</td>\n      <td>1.18, 1.19, 1.20, 1.21, 1.22</td>\n      <td>1.16, 1.17</td>\n    </tr>\n    <tr>\n      <td>1.10</td>\n      <td>No</td>\n      <td>1.18, 1.19, 1.20, 1.21</td>\n      <td>1.16, 1.17, 1.22</td>\n    </tr>\n    <tr>\n      <td>1.9</td>\n      <td>No</td>\n      <td>1.17, 1.18, 1.19, 1.20</td>\n      <td>1.15, 1.16</td>\n    </tr>\n    <tr>\n      <td>1.8</td>\n      <td>No</td>\n      <td>1.16, 1.17, 1.18, 1.19</td>\n      <td>1.15</td>\n    </tr>\n    <tr>\n      <td>1.7</td>\n      <td>No</td>\n      <td>1.16, 1.17, 1.18</td>\n      <td>1.15</td>\n    </tr>\n  </tbody>\n</table>\n\n<p>Visit <a href=\"https://istio.io/latest/docs/releases/supported-releases/#support-status-of-istio-releases\">istio.io</a> for more details.</p>\n\n<h3 id=\"original-cli\">Original CLI</h3>\n\n<pre><code class=\"language-bash\">export VERSION=1.14.0\ncurl -L https://istio.io/downloadIstio | ISTIO_VERSION=${VERSION} sh -\ncd istio-$VERSION\nexport PATH=$PWD/bin:$PATH\nistioctl install --set profile=demo\n</code></pre>\n\n<p>See <a href=\"#profile\">profile section</a>.</p>\n\n<h3 id=\"getmesh\">GetMesh</h3>\n\n<pre><code class=\"language-bash\">curl -sL https://istio.tetratelabs.io/getmesh/install.sh | bash\ngetmesh istioctl install --set profile=demo\n</code></pre>\n\n<h2 id=\"istio-operator\">Istio Operator</h2>\n\n<h3 id=\"operator\">Operator</h3>\n\n<h4 id=\"demo-profileyaml\">demo-profile.yaml</h4>\n\n<pre><code class=\"language-yaml\">apiVersion: v1\nkind: Namespace\nmetadata:\n  name: istio-system\n---\napiVersion: install.istio.io/v1alpha1\nkind: IstioOperator\nmetadata:\n  namespace: istio-system\n  name: demo-istio-install\nspec:\n  profile: demo\n</code></pre>\n\n<p class=\"-file\">Apply the operator:</p>\n\n<pre><code class=\"language-bash\">$ kubectl apply -f demo-profile.yaml  \nnamespace/istio-system created\nistiooperator.install.istio.io/demo-istio-install created\n</code></pre>\n\n<p>Visit <a href=\"https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/\">istio.io</a> for more details.</p>\n\n<h3 id=\"profile\">Profile</h3>\n\n<p>The profiles provide customization of the Istio control plane and of the sidecars for the Istio data plane.</p>\n\n<table class=\"-headers\">\n  <thead>\n    <tr>\n      <th>component</th>\n      <th>default</th>\n      <th>demo</th>\n      <th>minimal</th>\n      <th>preview</th>\n    </tr>\n  </thead>\n  <tbody>\n    <tr>\n      <td>egress gateway</td>\n      <td> </td>\n      <td>✔</td>\n      <td> </td>\n      <td> </td>\n    </tr>\n    <tr>\n      <td>ingress gateway</td>\n      <td>✔</td>\n      <td>✔</td>\n      <td> </td>\n      <td>✔</td>\n    </tr>\n    <tr>\n      <td>istiod</td>\n      <td>✔</td>\n      <td>✔</td>\n      <td>✔</td>\n      <td>✔</td>\n    </tr>\n  </tbody>\n</table>\n\n<p>Except the profiles above, there are <code>external</code> and <code>empty</code> profile that will not install any component list within the table.</p>\n\n<h2 id=\"resources-limiting\">Resources Limiting</h2>\n\n<h3 id=\"sidecar\">Sidecar</h3>\n\n<p>Using the various resource <a href=\"https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/\">annotations</a> that Istio supports to control sidecar behavior.</p>\n\n<ul>\n  <li><code>sidecar.istio.io/proxyCPU</code> : Specifies the requested CPU setting for the Envoy sidecar.</li>\n  <li><code>sidecar.istio.io/proxyCPULimit</code>: Specifies the CPU limit for the Envoy sidecar.</li>\n  <li><code>sidecar.istio.io/proxyMemory</code>: Specifies the requested memory setting for the Envoy sidecar.</li>\n  <li><code>sidecar.istio.io/proxyMemoryLimit</code>:  Specifies the memory limit for the Envoy sidecar.</li>\n</ul>\n\n<p><a href=\"https://istio.io/latest/docs/reference/config/annotations/\">See the details</a> of sidecar annotations.</p>\n\n<h2 id=\"checklist\">Checklist</h2>\n\n<h3 id=\"install-distroless-images\">Install distroless images</h3>\n\n<pre><code class=\"language-bash\">istioctl install --set tag=1.xx.x-distroless\n</code></pre>\n\n<p>Replace <code>1.xx.x</code> with the right version number.</p>\n\n<h3 id=\"platforms\">Platforms</h3>\n\n<ul>\n  <li>For platform <a href=\"https://istio.io/latest/docs/setup/platform-setup/\">set up</a>.</li>\n  <li>Different cloud providers have different configuration requirements to enable Istio CNI. To have CNI enabled, AKS clusters would have to be created with the <code>--network-plugin azure</code> flag added. <a href=\"https://istio.io/latest/docs/setup/additional-setup/cni/#hosted-kubernetes-settings\">Click here</a> for further details.</li>\n</ul>\n\n<h3 id=\"automatic-namespace-level-sidecar-injection\">Automatic namespace level sidecar injection</h3>\n\n<pre><code class=\"language-bash\">kubectl label &lt;namespace&gt; default istio-injection=enabled\n</code></pre>\n\n<h3 id=\"others\">Others</h3>\n\n<ul>\n  <li>Always do pre and post checks after Istio installation. This is enabled by default when installing Istio through <a href=\"https://docs.tetrate.io/download/\">Tetrate Istio Distro</a>.</li>\n  <li>Starting with Istio 1.8, Istio by default would merge application metrics into Istio metrics by scraping prometheus.io annotations. This may not be suitable where application metrics data are considered sensitive. This default merge can be disabled at the mesh level by passing <code>--set meshConfig.enablePrometheusMerge=false</code> during installation. Or this feature can be disabled per workload by adding a <code>prometheus.istio.io/merge-metrics: \"false\"</code> annotation on a pod. <a href=\"https://istio.io/latest/docs/ops/integrations/prometheus/\">Click here</a> for further details.</li>\n</ul>",
  "intro_html": "<p>Cheatsheet for installing the Istio control plane on Kubernetes.</p>",
  "description_html": "",
  "tags": ["Featured"],
  "updated": "2022-03-17"
},{
  "id": "traffic-management",
  "title": "Traffic Management",
  "url": "/traffic-management",
  "category": "Resources",
  "keywords": null,
  "content_html": "<h2 id=\"intro\">Intro</h2>\n\n<h3 id=\"resources\">Resources</h3>\n\n<ul>\n  <li><a href=\"#gateway\"><code>Gateway</code></a> describes a load balancer operating at the edge of the mesh receiving incoming or outgoing HTTP/TCP connections.</li>\n  <li><a href=\"#virtualservice\"><code>VirtualService</code></a>  defines a set of traffic routing rules to apply when a host is addressed.</li>\n  <li><a href=\"#destinationrule\"><code>DestinationRule</code></a> defines policies that apply to traffic intended for a service after routing has occurred.</li>\n  <li><a href=\"#workloadentry\"><code>WorkloadEntry</code></a> enables operators to describe the properties of a single non-Kubernetes workload such as a VM or a bare metal server as it is onboarded into the mesh.</li>\n  <li><a href=\"#workloadgroup\"><code>WorkloadGroup</code></a> describes a collection of workload instances.</li>\n</ul>\n\n<h2 id=\"gateway\">Gateway</h2>\n\n<h3 id=\"sample\">Sample</h3>\n\n<h4 id=\"sampletraffic-managementgatewayyaml\">sample/traffic-management/gateway.yaml</h4>\n\n<pre data-line=\"6,13\"><code class=\"language-yaml\">apiVersion: networking.istio.io/v1alpha3\nkind: Gateway\nmetadata:\n  name: bookinfo-gateway\nspec:\n  selector:\n    istio: ingressgateway\n  servers:\n  - port:\n      number: 80\n      name: http\n      protocol: HTTP\n    hosts:\n    - \"bookinfo/*\"\n</code></pre>\n\n<p>After creating the Gateway, you also need to create a <a href=\"#virtualservice\">VirtualService</a> to bind to it.</p>\n\n<h3 id=\"fields\">Fields</h3>\n\n<p>The interpretation of the fields in the sample.</p>\n\n<ul>\n  <li><code>selector</code>: all pods with <code>istio: ingressgateway</code> labels will act as edge proxy.</li>\n  <li><code>hosts</code>: it allows any VirtualService in the <code>bookinfo</code> namespace to bind to it. If the Gateway is deployed in the <code>bookinfo</code> namespace, <code>bookinfo</code> can be omitted here.</li>\n</ul>\n\n<h2 id=\"virtualservice\">VirtualService</h2>\n\n<h3 id=\"sample-1\">Sample</h3>\n\n<h4 id=\"sampleresourcesvirtualserviceyaml\">sample/resources/virtualservice.yaml</h4>\n\n<pre data-line=\"6,8,17,19,27\"><code class=\"language-yaml\">apiVersion: networking.istio.io/v1alpha3\nkind: VirtualService\nmetadata:\n  name: bookinfo\nspec:\n  hosts:\n  - \"*\"\n  gateways:\n  - bookinfo-gateway\n  http:\n  - match:\n    - uri:\n        exact: /productpage\n    - uri:\n        prefix: /static\n    - uri:\n        exact: /login\n    - uri:\n        exact: /logout\n    - uri:\n        prefix: /api/v1/products\n    route:\n    - destination:\n        host: productpage\n        port:\n          number: 9080\n        subset: v1\n</code></pre>\n\n<p>This VirtualService is bound to the <a href=\"#gateway\">Gateway</a> above. VirtualService and <a href=\"#destinationrule\">DestinationRule</a> are the basic configuration that affect the traffic routing.</p>\n\n<h3 id=\"fileds\">Fileds</h3>\n\n<p>The interpretation of the fields in the sample.</p>\n\n<ul>\n  <li><code>hosts</code>: The destination hosts to which traffic is being sent. You should notice that this is an array where you can configure multiple hosts at the same time, i.e. control all traffic destined for these hosts.</li>\n  <li><code>http</code>: An ordered list of route rules for HTTP traffic. Note that rules are executed sequentially, so if the previous rule matches, the later rule will not be executed.</li>\n  <li><code>route</code>:  A HTTP rule can either redirect or forward (default) traffic. It describes match conditions and actions for routing HTTP/1.1, HTTP2, and gRPC traffic.</li>\n  <li><code>subset</code>: One or more named sets that represent individual versions of a service. It can be used for scenarios like A/B testing, or routing to a specific version of a service. You need to config subsets on a <a href=\"#destinationrule\">DestinationRule</a>.</li>\n</ul>\n\n<p>Visit <a href=\"https://istio.io/latest/docs/reference/config/networking/virtual-service/\">istio.io</a> for more details.</p>\n\n<h2 id=\"destinationrule\">DestinationRule</h2>\n\n<h3 id=\"sample-2\">Sample</h3>\n\n<h4 id=\"sampleresourcesdestinationruleyaml\">sample/resources/destinationrule.yaml</h4>\n\n<pre><code class=\"language-yaml\">apiVersion: networking.istio.io/v1alpha3\nkind: DestinationRule\nmetadata:\n  name: productpage\nspec:\n  host: productpage.bookinfo.svc.cluster.local\n  trafficPolicy:\n    loadBalancer:\n      simple: LEAST_CONN\n  subsets:\n  - name: v1\n    labels:\n      version: v1\n</code></pre>\n\n<h3 data-line=\"6,7,10\" id=\"fileds-1\">Fileds</h3>\n\n<p>The interpretation of the fields in the sample.</p>\n\n<ul>\n  <li><code>host</code>:  The name of a service from the service registry. <code>productpage.bookinfo.svc.cluster.local</code> stand for a service called <code>productpage</code> in <code>bookinfo</code> namespace in Kubernetes.</li>\n  <li><code>trafficPolicy</code>: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection).</li>\n  <li><code>subsets</code>: One or more named sets that represent individual versions of a service. It can be used for scenarios like A/B testing, or routing to a specific version of a service. It will be referred from <a href=\"virtualservice\">VirtualService</a>.</li>\n</ul>\n\n<p>Visit <a href=\"https://istio.io/latest/docs/reference/config/networking/destination-rule\">istio.io</a> for more details.</p>\n\n<h2 id=\"workloadentry\">WorkloadEntry</h2>\n\n<h3 id=\"sample-3\">Sample</h3>\n\n<h4 id=\"sampleresourcesworkloadentryyaml\">sample/resources/workloadentry.yaml</h4>\n\n<pre data-line=\"6,7,8\"><code class=\"language-yaml\">apiVersion: networking.istio.io/v1alpha3\nkind: WorkloadEntry\nmetadata:\n  name: details-we\nspec:\n  serviceAccount: details-legacy\n  address: 2.2.2.2\n  labels:\n    app: details-legacy\n    instance-id: vm1\n</code></pre>\n\n<h3 id=\"fields-1\">Fields</h3>\n\n<p>The interpretation of the fields in the sample.</p>\n\n<ul>\n  <li><code>serviceAccount</code>: the service account must be present in the same namespace as the configuration.</li>\n  <li><code>address</code>: IP address without port, FQDN or UNIX socket.</li>\n  <li><code>labels</code>: one or more labels associated with the endpoint. <a href=\"#workloadgroup\">WorkloadGroup</a> will refer to them.</li>\n</ul>\n\n<h2 id=\"workloadgroup\">WorkloadGroup</h2>\n\n<h3 id=\"samples\">Samples</h3>\n\n<h4 id=\"sampleresourcesworkloadgroupyaml\">sample/resources/workloadgroup.yaml</h4>\n\n<pre data-line=\"9\"><code class=\"language-yaml\">apiVersion: networking.istio.io/v1alpha3\nkind: WorkloadGroup\nmetadata:\n  name: details-wg\nspec:\n  metadata:\n    labels:\n      app.kubernetes.io/name: details\n  template:\n    ports:\n      http: 8080\n    serviceAccount: default\n  probe:\n    initialDelaySeconds: 5\n    timeoutSeconds: 3\n    periodSeconds: 4\n    successThreshold: 3\n    failureThreshold: 3\n</code></pre>\n\n<h3 id=\"fields-2\">Fields</h3>\n\n<p>The interpretation of the fields in the sample.</p>\n\n<ul>\n  <li><code>template</code>：to be used for the generation of <code>WorkloadEntry</code> resources that belong to this <code>WorkloadGroup</code>.</li>\n</ul>\n\n<p>Visit <a href=\"https://istio.io/latest/docs/reference/config/networking/workload-group/\">istio.io</a> for more details.</p>",
  "intro_html": "<p>Traffic management API configurations.</p>",
  "description_html": "",
  "tags": ["Featured"],
  "updated": "2022-03-25"
}
]