Service Mesh (Istio) Cheat Sheet

Core Istio concepts for traffic management, mTLS security, and observability using sidecar proxies in a Kubernetes cluster.

3 PagesAdvancedJan 28, 2026

Core Istio Components

The main building blocks of an Istio service mesh.

Envoy sidecar- Proxy injected alongside each pod that intercepts all inbound/outbound traffic
Istiod- Control plane component handling configuration, certificate issuance, and service discovery
VirtualService- Defines routing rules for traffic to a service, e.g. weighted splits, retries
DestinationRule- Defines policies applied after routing, e.g. subsets, load balancing, TLS settings
Gateway- Configures a load balancer for ingress/egress traffic at the mesh edge

Enable Sidecar Injection

Label a namespace so Istio automatically injects the Envoy sidecar.

bash

kubectl label namespace default istio-injection=enabled# Verify injection on existing pods (requires rollout restart)kubectl rollout restart deployment -n default

Canary Traffic Split

Route 90% of traffic to v1 and 10% to v2 for a canary rollout.

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: reviewsspec:  hosts:    - reviews  http:    - route:        - destination:            host: reviews            subset: v1          weight: 90        - destination:            host: reviews            subset: v2          weight: 10

DestinationRule with Subsets

Define version-based subsets referenced by a VirtualService.

yaml

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  trafficPolicy:    tls:      mode: ISTIO_MUTUAL  subsets:    - name: v1      labels:        version: v1    - name: v2      labels:        version: v2

Enforce mTLS Cluster-Wide

PeerAuthentication policy requiring strict mutual TLS for the mesh.

yaml

apiVersion: security.istio.io/v1beta1kind: PeerAuthenticationmetadata:  name: default  namespace: istio-systemspec:  mtls:    mode: STRICT

Pro Tip

Roll out mTLS with `PERMISSIVE` mode first, monitor for failed connections from non-meshed clients, then switch to `STRICT` — jumping straight to strict mTLS commonly breaks traffic from services that haven't been onboarded to the mesh yet.

Was this cheat sheet helpful?

Kubernetes Helm Charts Cheat Sheet

API Gateway Patterns Cheat Sheet

Explore Topics

#ServiceMeshIstio#ServiceMeshIstioCheatSheet#DevOps#Advanced#CoreIstioComponents#EnableSidecarInjection#CanaryTrafficSplit#DestinationRuleWithSubsets#Security#Kubernetes#CheatSheet#SkillVeris

Sri Hayavadhana Info-Tech

Professional Web Designing Services