Gateway
Bindet Ports/Hosts/TLS am Edge-Proxy. servers[].port
+ tls.mode: SIMPLE, MUTUAL,
PASSTHROUGH, ISTIO_MUTUAL.
credentialName verweist auf Secret im selben Namespace
wie der Gateway-Pod.
apiVersion: networking.istio.io/v1
kind: Gateway
metadata: {name: web-gw, namespace: istio-system}
spec:
selector: {istio: ingressgateway}
servers:
- port: {number: 443, name: https, protocol: HTTPS}
hosts: ["www.istio-cheatsheet.de"]
tls:
mode: SIMPLE
credentialName: web-cert
VirtualService
Routing-Regeln. Bindet hosts an gateways
(oder mesh für Ost-West). Match-Reihenfolge ist
signifikant, erste Treffer-Regel gewinnt. Header-Keys
lowercase, Header-Werte und Pfad case-sensitive (Pfad:
ignoreUriCase: true).
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: {name: reviews}
spec:
hosts: [reviews]
http:
- match:
- headers: {end-user: {exact: jason}}
route:
- destination: {host: reviews, subset: v2}
- route:
- destination: {host: reviews, subset: v1}
weight: 90
- destination: {host: reviews, subset: v3}
weight: 10
retries:
attempts: 3
perTryTimeout: 2s
retryOn: gateway-error,connect-failure,refused-stream
timeout: 10s
DestinationRule
Subsets (Versionen) + Traffic-Policy (LB, Connection-Pool,
Outlier Detection, TLS). Wirkt erst nach VirtualService-Routing.
host muss FQDN oder Short-Name im selben Namespace
sein.
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: {name: reviews}
spec:
host: reviews
trafficPolicy:
connectionPool:
tcp: {maxConnections: 100}
http:
http1MaxPendingRequests: 64
http2MaxRequests: 1000
maxRequestsPerConnection: 10
outlierDetection:
consecutive5xxErrors: 5
interval: 30s
baseEjectionTime: 60s
loadBalancer:
consistentHash:
httpHeaderName: x-user-id
subsets:
- name: v1
labels: {version: v1}
- name: v2
labels: {version: v2}
ServiceEntry
Externe Hosts in den Mesh-Registry holen (DB, SaaS, REST-APIs).
MESH_EXTERNAL + DNS resolution sind die
saubere Default-Kombi. Ohne ServiceEntry bleibt der Egress-Traffic
BlackHoleCluster wenn
outboundTrafficPolicy=REGISTRY_ONLY.
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata: {name: stripe-api}
spec:
hosts: ["api.stripe.com"]
ports:
- {number: 443, name: https, protocol: HTTPS}
resolution: DNS
location: MESH_EXTERNAL
Sidecar
Begrenzt, was ein Workload aus der Mesh-Registry sieht,
kritisch für Memory-Footprint und Push-Latenz
in großen Clustern. Default: jeder Sidecar bekommt Config
für alle Services. Ab 1.31 zieht ein ~-Präfix
Namespaces ab: */* + ~ns1/*.
apiVersion: networking.istio.io/v1
kind: Sidecar
metadata: {name: default, namespace: prod}
spec:
egress:
- hosts:
- "./*" # nur eigener Namespace
- "istio-system/*"
- "shared/*"