Istio Traffic Management

/istio-traffic-management

When to Use

• Canary deploy: route 10% of agent traffic to new version, ramp up if metrics pass
• Circuit breaking: stop sending requests to unhealthy agent pods automatically
• mTLS: encrypt all inter-agent traffic without modifying application code
• Fault injection: test agent resilience by injecting 500ms delay or 10% error rate

Do NOT use for

• North-south traffic (Ingress) — use [[traefik-ingress-routing]]
• Simple environments without multi-service communication

VirtualService (traffic splitting: canary)

# Route 90% to v1, 10% to v2 (canary rollout)
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: yamtam-agent
spec:
  hosts:
    - yamtam-agent
  http:
    - match:
        - headers:
            x-canary: { exact: "true" }   # force canary for testers
      route:
        - destination: { host: yamtam-agent, subset: v2 }
    - route:
        - destination: { host: yamtam-agent, subset: v1 }
          weight: 90
        - destination: { host: yamtam-agent, subset: v2 }
          weight: 10

DestinationRule (load balancing + circuit breaker)

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: yamtam-agent
spec:
  host: yamtam-agent
  trafficPolicy:
    connectionPool:
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests:        1000
    outlierDetection:            # circuit breaker
      consecutive5xxErrors:  5   # open circuit after 5 consecutive 5xx
      interval:              30s # scan interval
      baseEjectionTime:      60s # eject for 60s
      maxEjectionPercent:    50  # never eject > 50% of pods
  subsets:
    - name: v1
      labels: { version: v1 }
    - name: v2
      labels: { version: v2 }
      trafficPolicy:
        loadBalancer: { simple: LEAST_CONN }

Mutual TLS policy (auto-encrypt all agent traffic)

# PeerAuthentication: require mTLS in yamtam namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name:      yamtam-mtls
  namespace: yamtam
spec:
  mtls:
    mode: STRICT   # reject plaintext connections

---
# AuthorizationPolicy: agent-A can only call agent-B's /task endpoint
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: agent-b-authz
  namespace: yamtam
spec:
  selector:
    matchLabels: { app: agent-b }
  action: ALLOW
  rules:
    - from:
        - source: { principals: ["cluster.local/ns/yamtam/sa/agent-a"] }
      to:
        - operation: { methods: ["POST"], paths: ["/task/*"] }

Fault injection (chaos testing)

# Inject 500ms delay for 50% of requests to agent-b
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: agent-b-chaos
spec:
  hosts: [agent-b]
  http:
    - fault:
        delay:
          percentage: { value: 50 }
          fixedDelay: 500ms
        abort:
          percentage: { value: 10 }
          httpStatus: 503
      route:
        - destination: { host: agent-b }

Anti-Fake-Pass Checklist

❌ Namespace not labeled with istio-injection: enabled → Envoy sidecar not injected, no mesh
❌ PeerAuthentication STRICT without all services having Istio sidecar → plaintext traffic rejected
❌ VirtualService hosts not matching Service name exactly → traffic not intercepted
❌ outlierDetection without connectionPool → circuit breaker ineffective on high concurrency
❌ Canary weight totals ≠ 100 → Istio rejects VirtualService configuration
❌ Fault injection left enabled in production → intentional errors become real customer impact