What is Istio? What Does it Solve?

Istio started as a collaboration among three companies, Google, IBM, and Lyft to develop an open cloud service to connect, secure, manage and monitor a network of microservices regardless of platform, source or vendor.

In this blog, you will learn what Istio is, why it is used, and the problems it solves like traffic management, security, observability, and service-to-service communication in Kubernetes.

What is Istio?

Containerization has made microservices deployments simple and easier and the adoption of microservices is increasing day by day. Microservices architecture allows the developers to decouple a big application into smaller units and these smaller units talk to each other using API's.

Also, each microservice can be deployed by teams individually rather than waiting for the whole application to be developed for deployment.

Managing these microservice on a large scale poses the following challenges

Discovering services - Finding a healthy service to route the traffic
Balancing the request load - Evenly distribute the traffic across services
Security - Ensuring the communication is encrypted and that the allowed services only communicate.
Controlling Traffic - Routing traffic to new services using methods such as Canary.
Handling Failures - Controlling retries for the failed requests and preventing failures.
Monitoring - Tracking the performance and failures by logs, metrics, and traces.

Here is where Istio comes in to play.

Istio helps us solve the difficulties by acting as an infrastructure layer to manage the communication between services. You can call it a service mesh.

💡

A service mesh is a dedicated infrastructure layer within the platform that manages service-to-service communication.

Istio works very closely with the services using lightweight proxies to handle the traffic.

💡

The original Istio architecture is Sidecar, which means a proxy runs alongside each pod. Recently, they have introduced a new method called Ambient Mode which does not run as sidecar.

Also, the only supported platform for Istio is Kubernetes.

Core Features of Istio

The following are some of the important features of Istio.

1. Traffic Control

Istio has the Custom Resource Definitions (CRDs) to configure the settings to define how the traffic should flow.

The routing rules in Istio are configured using the Virtual Service Custom Resource.

In Virtual Service, we can control the traffic based on.

Host
Path
Headers
Labels

We can even split the traffic between different service versions to perform Canary or A/B testing, which means we can control how much traffic should be routed to each service.

💡

We can perform chaos engineering using Istio's fault injection. This allows us to add intentional delays and errors in requests to validate the stability and resilience of our system.

Another Custom Resource of the Istio is the Destination Rule, which allows us to configure the following settings.

Timeout - How long should we wait for a request to resolve
Retries - How many times does a request need to be retried for a failed request
Circuit Breaking - What should you do if a service endpoint is unhealthy.
Connection Pooling - How much traffic should be routed on a service.

2. Security

Istio uses strong cryptographic identities to ensure secure and encrypted communication between the services. (Follows SPIFFE framework and X.509 certificates)

Here, the Control Plane (Istiod) acts as a Certificate Authority (CA) to generate and manage the certificates. The data planes perform the mTLS handshake to ensure the identity.

Authorization Policy is another CRD that defines who should access the services.

We can define Authentication rules to cluster scoped or namespace scoped and
Allow or deny the authorization based on identity, source namespace, source IP, request method (GET, POST), headers, and JWT.

For authentication, Istio uses the following:

Validate the JWT tokens on the Ingress gateway or the services themselves.
Istio even works with the external OIDC providers like Keycloak, Auth0, etc.

3. Observability

Istio has built-in configurations to generate the telemetry of the traffic flow.

Istio will generate the following:

Metrics
Traces
Logs

We can observe these using tools like Prometheus and Grafana.

Istio Real World Case Studies

Istio or service mesh is not new, a lot of organizations already use them. The following are some of the real case studies.

Rappi initially built its own service mesh, though when the services increased to thousands of containers, it moved to Istio to manage it.
Atlassian used to use Envoy proxy for the communication, but for the benefits of Istio Daemon, they have moved to Istio.
eBay has thousands of running containers. To ensure network communication and security during the scaling, they have started using Istio.

There are more case studies available that you can refer to here.