Summary

Documentation Index

Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt

Use this file to discover all available pages before exploring further.

• Sidecar proxy: intercepts inbound and outbound traffic for a workload. By default it can route all outbound traffic. Use a Sidecar resource to restrict egress and limit which services a workload may reach.
• Mutual TLS (mTLS): enable mesh-wide or namespace/workload-level mTLS with PeerAuthentication and mode: STRICT.
• VirtualService: controls runtime routing behavior — retries, timeouts, traffic mirroring/shadowing, fault injection (delays/aborts), and routing rules (weights, headers).
• DestinationRule: complements VirtualService by defining subsets, load-balancing policy, connection pools, and circuit-breaking/outlier detection.
• EgressGateway and ServiceEntry: control traffic leaving the mesh and allow external services to be part of the service registry so policies and telemetry apply.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: namespace-strict
  namespace: my-namespace
spec:
  mtls:
    mode: STRICT

​

VirtualService vs DestinationRule — what goes where

• Traffic splitting (weights), header-based routing, path rewrites.
• Fault injection (delays, aborts), retries, timeouts, and mirroring via the mirror field.

• Define subsets (e.g., v1, v2) that VirtualService can target.
• Set trafficPolicy for load balancing, connection pools, and circuit breakers (outlier detection, max connections, max pending requests).

​

Mirroring, circuit breaking, and egress

• Traffic mirroring (also called traffic shadowing) lets you send a copy of production traffic to a candidate service without affecting responses to users. Configure mirroring in the VirtualService using the mirror field; destination subsets can be defined in a DestinationRule if needed.
• Circuit breaking prevents cascading failures. Configure limits such as maxConnections, maxPendingRequests, and outlierDetection in a DestinationRule under trafficPolicy.
• To observe and control traffic leaving the mesh, use an EgressGateway. To bring an external service under Istio control (policies, telemetry), create a ServiceEntry.

​

Connection limits, rate limiting, and fault injection

• Connection limits live in DestinationRule under trafficPolicy.connectionPool. Examples:
  • tcp.maxConnections
  • http.http2MaxRequests
  • http.http1MaxPendingRequests (for HTTP/1)
• Request-rate limiting is typically implemented via Envoy rate-limit filters or an external rate-limit service integrated via Envoy filters — not directly via VirtualService/DestinationRule fields.
• Fault injection belongs to VirtualService. You can:
  • Inject fixed delays (seconds) for a given percentage of traffic.
  • Abort requests with a specified HTTP status code for some traffic percentage.

​

Waypoint proxies and HTTPRoute (brief)

• Waypoint proxies provide a single, centralized hop for traffic entering or leaving a namespace. They are often used in larger deployments for observability and policy enforcement.
• HTTPRoute (part of the Gateway API) can be used for advanced routing scenarios alongside waypoint proxies.
• For exam-level coverage (ICA exam course or the KodeKloud course referenced in the module), you may only be asked to install and label namespaces or waypoint proxy namespaces to opt-in. Make sure to:
  • Label namespaces appropriately when using ambient mode.
  • Install and label waypoint-proxy namespaces when opting workloads into waypoint behavior.