Istio Quick Reference

Chapters

1. 01

   Architecture

   Datapath from ingress gateway to sidecar, istiod and the Envoy version, install profiles and canary installation with a revision tag.

2. 02

   Traffic Management

   Gateway, VirtualService, DestinationRule, ServiceEntry and Sidecar scoping with copyable YAML, retries, outlier detection and connection-pool defaults.

3. 03

   Security

   PeerAuthentication and the migration to mTLS STRICT, AuthorizationPolicy with evaluation order, RequestAuthentication for JWT and SPIFFE identity.

4. 04

   Observability

   Telemetry API, standard metrics such as istio_requests_total, trace header propagation and access logging through OpenTelemetry.

5. 05

   Performance & Tuning

   Sidecar sizing, Pilot tuning against push storms, ambient mode with ztunnel and waypoint, sidecars in Jobs and CronJobs, graceful drain.

6. 06

   Multi-Cluster

   Primary-remote, multi-primary and external control plane topologies, shared root CA, trustDomain, meshID, clusterName and remote secrets.

7. 07

   Diagnostics

   istioctl proxy-status, proxy-config and analyze in the order of an incident, sidecar logs and the failure modes 404 NR and 503 UF, UC and UH.

8. 08

   Gateway API (v1, kubernetes-sigs)

   Where the Gateway API stands in Istio 1.31, CRD order during an upgrade and allowedRoutes for routes from other namespaces, with a YAML example.

9. 09

   Release & Support

   Release cadence, support until six weeks after the N+2 release, in-place and canary upgrades, and the move of the image registry.

10. 10

    Anti-Patterns

    What goes wrong in Istio operations: default sidecar resources, mesh VirtualServices without Sidecar scoping, STRICT without migration, EnvoyFilter as a default tool.

All chapters on one page, to search with Ctrl+F and to print.