Istio Masterclass
- 1 minutes read - 169 wordsThis talk by Dawid Ziolkowski at DevOpsDays Warsaw is a clear introduction to Istio. If you’ve heard of service meshes but never quite grasped what problems they solve, it’s a good place to start - it covers what a mesh gives you (traffic management, observability and mutual TLS between services) and how Istio implements it on top of Kubernetes.
Once you’re past the basics, the mutual TLS that makes a mesh appealing can also
bite you in the corners. We hit one such corner running an egress gateway:
combining hosts: ["*"] with tls.mode: ISTIO_MUTUAL and SNI-based routing
(sniHosts) silently fails to install the :443 listener - ISTIO_MUTUAL
wants to terminate TLS before routing, while sniHosts needs to read the SNI
from the ClientHello before termination, and Envoy can’t compose a filter
chain that does both. The fix is to drop the wildcard for an explicit list of
hostnames (or switch to PASSTHROUGH and handle mTLS at the sidecar). We wrote
it up in a
discussion on the Istio repo.