Istio is a service mesh that adds traffic management, security, and observability to a network of microservices — without requiring changes to application code. It works by transparently injecting a proxy (Envoy) alongside every workload and managing that fleet of proxies from a central control plane.

How it works

Istio’s control plane, istiod, configures a sidecar Envoy proxy injected next to each application container. All traffic between services flows through these sidecars, which is what lets Istio enforce mutual TLS, apply retries and timeouts, split traffic between versions for canary releases, and collect uniform metrics and traces — all from configuration, with zero application-level changes.

Core concepts

• Sidecar proxy — the Envoy instance injected alongside each workload Pod, which intercepts and manages all its inbound and outbound traffic.
• VirtualService — defines routing rules for traffic to a service: version splits, retries, timeouts, and fault injection.
• DestinationRule — defines policies applied after routing, such as load-balancing strategy and mutual TLS settings, for a given service’s subsets.
• Gateway — configures a load balancer at the edge of the mesh for ingress or egress traffic.

Why teams adopt Istio

• mTLS without code changes. Service-to-service traffic can be encrypted and authenticated mesh-wide through configuration alone.
• Fine-grained traffic control. Canary releases, A/B testing, and fault injection are declarative routing rules, not application logic.
• Uniform observability. Every service gets consistent metrics, logs, and distributed traces, even ones you didn’t instrument yourself.
• Policy enforcement. Authorization, rate limiting, and retries are enforced consistently across every service in the mesh.

Getting started

Install Istio into a cluster, label the namespaces you want meshed for automatic sidecar injection, and deploy your workloads as usual — the proxies attach automatically. The guides below cover enabling the mesh, traffic splitting, and securing service-to-service communication.