Скачать или смотреть Understanding Istio

*YouTube Video Summary Suggestion: Introduction to Istio*

---
*Title:* Istio Service Mesh 101: Understanding the Architecture and Microservice Challenges (Chapter 1 Overview)

*Description:*

Welcome to the introduction to Istio, the service mesh platform designed for application architects and development team leads focused on cloud-native applications built on the microservices architectural style. This overview explores the critical challenges Istio helps solve and details its essential components.

*The Challenge:*
In the era of digital transformation, teams are pursuing vastly faster deployment times through the microservices architecture. This approach introduces significant hazards, primarily stemming from the fallacies of distributed computing, particularly the unreliability of the network connecting microservices. Historically, frameworks like Netflix OSS (e.g., Ribbon, Hystrix, Eureka) attempted to solve these resilience challenges, but they were often language and platform specific, leading to massive maintenance overhead, redundancy, and non-uniform behaviors. While *Linux containers* and *Kubernetes/OpenShift* enable high velocity and managing polyglot services, they do not address how those individual services interact with one another.

*Meet Istio (The Service Mesh Solution):*
Istio is an implementation of a **service mesh**. The service mesh acts as the connective tissue between your services, allowing applications to offload crucial cross-cutting concerns—such as **traffic control**, **resilience**, **observability**, **security**, and **service discovery**—from application-level libraries. Istio provides developers and architects with **richer and declarative service discovery and routing capabilities**.

Key benefits of Istio include:
*Finely grained routing rules* among all services within the mesh, moving beyond Kubernetes' default round-robin load balancing.
Greater **observability**, allowing users to drill down into network topology, tracing flows, and viewing key metrics immediately.
Network-level *resiliency capabilities* such as retry, timeout, and implementing various *circuit-breaker* capabilities.
The foundation for **chaos engineering**, which is explored later in the book (Chapter 5), allowing you to inject chaos to test your application’s robustness.

*Understanding Istio Components:*
The Istio service mesh is primarily composed of two major areas: the *data plane* and the **control plane**.

1. *The Data Plane:*
The data plane is implemented to intercept all inbound (ingress) and outbound (egress) network traffic transparently to the microservice business logic.
It is made up of the *service proxy* and the **sidecar container**.
The default service proxy for Istio is **Envoy Proxy**. Envoy is a highly performant, battle-tested Layer 7 proxy developed by Lyft, providing features like load balancing, metric collection, and tracing.
Envoy is deployed using the *sidecar* pattern. The sidecar is a second Linux container, known as **`istio-proxy`**, which lives directly alongside your microservice container. This sidecar is responsible for intercepting all traffic and applying new policies, capturing monitoring data, and even introducing chaos injection.

2. *The Control Plane:*
The control plane is the authoritative source for policy and configuration, making the data plane usable across a cluster.
It comprises three primary Istio services: **Pilot**, **Mixer**, and **Auth**.
*Pilot* manages the overall fleet, ensuring all distributed microservices have an up-to-date view of the overall topology and current "routing table". It provides service discovery and supports *`RouteRule`* for fine-grained request distribution and *`DestinationPolicy`* to address resiliency (timeouts, retries, circuit breaker).
*Mixer* gathers telemetry from the distributed `istio-proxies`. It maintains the canonical model of usage and access policies, allowing you to create *ACLs* (whitelist and blacklist), apply **rate-limiting rules**, and capture custom metrics.
*Auth* (Istio CA) is responsible for certificate issuance and rotation, supplying x509 certificates to all microservices to enable **mutual Transport Layer Security (mTLS)**, which transparently encrypts all service traffic.

(This book focuses on Istio on Kubernetes/OpenShift. If you need prerequisites, resources are available for Kubernetes/OpenShift, Spring Boot, Dropwizard, WildFly Swarm, and Reactive microservices using Vert.x.)