Istio

Istio is an open, platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. It manages communications between microservices without requiring changes to the underlying services, offering automated traffic resilience, service metrics, distributed tracing, traffic encryption, protocol upgrades, and advanced routing.

We recommend following the instructions on the getting started page, which installs a demonstration configuration along with Istio’s sample application, Bookinfo. You can then use this setup to walk through various Istio guides. For production Kubernetes deployments, refer to the deployment models documentation.

Istio offers several installation methods: istioctl install (recommended for most use cases), Helm, and generating Kubernetes manifests. istioctl install provides thorough configuration validation, health verification, and extensive customization options, while Helm offers familiar tooling but fewer checks. Manifest generation is suitable for strict auditing or third-party tooling constraints.

You can change mutual TLS settings for your services at any time using authentication policy and destination rule. Mutual TLS can be configured mesh-wide, namespace-wide, or for specific services, allowing flexible control over encryption.

Yes, Istio provides authorization features for both HTTP and plain TCP services in the mesh. This allows you to enforce access control policies across your services.

Contributions are highly welcome. You can contribute by submitting code, providing feedback, reporting bugs, or participating in discussions on the Istio forum, Slack, or Stack Overflow. The code repositories are hosted on GitHub, and detailed contribution guidelines are available.

Istio is designed to be platform-independent and initially focused on Kubernetes. As of the 1.29 release, Istio supports environments running Kubernetes versions 1.31, 1.32, 1.33, 1.34, and 1.35.

Ensure your cluster meets the prerequisites for automatic sidecar injection. Note that microservices deployed in kube-system, kube-public, or istio-system namespaces are exempted from automatic sidecar injection. Use a different namespace for your microservices.