Istio — Open Source Service Mesh for Microservices

What it is

Istio is an open-source service mesh that provides a uniform way to connect, secure, control, and observe services in a microservices architecture. It works by injecting Envoy sidecar proxies alongside each service pod in Kubernetes.

Istio targets platform teams running microservices on Kubernetes who need mutual TLS encryption, traffic routing (canary deployments, A/B testing), and distributed tracing without modifying application code.

How it saves time or tokens

Istio handles cross-cutting concerns (encryption, retry logic, circuit breaking, observability) at the infrastructure layer. Application developers do not need to implement mTLS, retry policies, or distributed tracing in their code. The service mesh handles it transparently via Envoy sidecars.

How to use

1. Install Istio on your Kubernetes cluster:

curl -L https://istio.io/downloadIstio | sh -
cd istio-*
export PATH=$PWD/bin:$PATH
istioctl install --set profile=demo -y

1. Enable sidecar injection for your namespace:

kubectl label namespace default istio-injection=enabled

1. Deploy your services normally. Istio automatically injects Envoy sidecars.

Example

# VirtualService for canary deployment
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: v1
          weight: 90
        - destination:
            host: my-service
            subset: v2
          weight: 10

Related on TokRepo

• DevOps Tools -- Infrastructure and Kubernetes tooling
• Security Tools -- mTLS and security infrastructure

Common pitfalls

• Istio sidecar injection increases pod resource usage. Each sidecar consumes CPU and memory. Plan cluster capacity accordingly.
• The learning curve is steep. Start with the demo profile for evaluation and graduate to production profiles after understanding the components.
• Istio version upgrades require careful planning. Sidecar proxies must be restarted after control plane upgrades.