Istio

lastmod 2025-12-22created 2021-05-0314 edits

Istio is a service mesh: a modernized service networking layer that provides a transparent, language-independent way to flexibly and easily automate application network functions. It is a widely used solution for managing the various microservices that make up cloud-native applications. The Istio service mesh also supports how these microservices communicate and share data with each other.

As organizations accelerate their move to the cloud, they are also modernizing their applications as needed. However, transitioning monolithic legacy apps to cloud-native apps can create challenges for DevOps teams.

Developers need to learn how to assemble apps from loosely coupled microservices to ensure portability in the cloud. At the same time, operations teams need to manage new cloud-native apps within ever-larger hybrid and multi-cloud environments. Istio lets you do these tasks.

Definition of Istio

Istio는 조직에서 분산형 마이크로서비스 기반 앱을 어디서나 실행할 수 있도록 지원하는 오픈소스 서비스 메시입니다. 왜 Istio를 사용해야 하나요? Istio를 통해 조직은 마이크로서비스를 보호, 연결, 모니터링할 수 있으므로 엔터프라이즈 앱을 더욱 빠르고 안전하게 현대화할 수 있습니다.

About

• Istio concepts and installation

When you develop applications with a microservice architecture, you end up with a great many applications and services.

Even for a single API call from outside, the request passes through many applications internally before a result comes back, so if a problem occurs, it is hard to tell which service has the problem.

Just as Kubernetes lets you manage containers abstracted as Pod, Replicaset, ReplicationController, Deployment, and so on, instead of managing them with plain docker commands, it is a tool that lets you manage things abstracted from the network side,

and providing features for communication between services, such as Korean: 보안, Korean: 로드밸런싱, Korean: 모니터링, HealthCheck, circuit breaker, and traffic handling logic, through abstraction inside the infrastructure is called a service mesh.

Istio is an implementation of a service mesh; a service mesh abstracts network communication through an additional layer between the software and the cluster (Kubernetes, etc.).

Platform Requirements

• Istio / Platform Requirements

Regardless of the Istio data plane¹ mode, using Istio in a Kubernetes environment generally requires Kubernetes nodes running a Linux kernel that supports traffic interception and routing. Istio supports two backends for traffic management: iptables (the default) and nftables.

Most Linux kernels released in the past 10 years include built-in support for the features Istio uses. These are kernel modules that are either autoloaded when needed or built in. The specific kernel modules required depend on which backend you choose to use.

iptables backend

When using the iptables backend (the default), the following kernel modules are required for Istio to function correctly:

Primary iptables Modules:

The following additional modules are used by the modules listed above and must also be loaded on the cluster node:

Save to the /etc/modules-load.d/istio-iptables.conf file:

# Primary iptables Modules
br_netfilter
ip6table_mangle
ip6table_nat
ip6table_raw
iptable_mangle
iptable_nat
iptable_raw
xt_REDIRECT
xt_connmark
xt_conntrack
xt_mark
xt_owner
xt_tcpudp
xt_multiport
ip_set

# The following additional modules are used by the above listed modules and should also be loaded on the cluster node:
bridge
ip6_tables
ip_tables
nf_conntrack
nf_conntrack_ipv4
nf_conntrack_ipv6
nf_nat
nf_nat_ipv4
nf_nat_ipv6
nf_nat_redirect
x_tables
ip_set_hash_ip

nftables backend

The nftables framework is a modern framework that replaces iptables, offering improved performance and flexibility.

Istio uses the nft CLI tool to configure nftables rules.

The nft binary must be version 1.0.1 or later, and Linux kernel version 5.13 or later is required.

# nft 버전 확인 (1.0.1 이상 필요)
nft --version

# 커널 버전 확인 (5.13 이상 필요)
uname -r

For the nft CLI to work correctly, the following kernel modules must be installed on the host system.

Save to the /etc/modules-load.d/istio-nftables.conf file:

# nftables backend
nf_tables
nf_conntrack
nft_ct
nf_defrag_ipv4
nf_defrag_ipv6
nft_nat
nft_socket
nft_tproxy
nft_redir

Installation status check script

#!/bin/bash
# Comprehensive Istio health check
# Istio 종합 상태 확인

echo "=== Checking Istio Pods ==="
kubectl get pods -n istio-system

echo -e "\n=== Checking Istio Services ==="
kubectl get svc -n istio-system

echo -e "\n=== Checking Istio Deployments ==="
kubectl get deployments -n istio-system

echo -e "\n=== Checking Istio HPA ==="
kubectl get hpa -n istio-system

echo -e "\n=== Checking Webhooks ==="
kubectl get mutatingwebhookconfigurations | grep istio
kubectl get validatingwebhookconfigurations | grep istio

echo -e "\n=== Checking Istio ConfigMaps ==="
kubectl get configmap -n istio-system

echo -e "\n=== Waiting for all pods to be ready ==="
kubectl wait --for=condition=ready pod --all -n istio-system --timeout=60s

See also

• Service mesh
• Envoy
• ZooKeeper
• etcd
• Eureka (Netflix)
• Consul (Hashcorp)
• Kubeflow:Install

Favorite site

• Istio web site

Basic

• 196. (Istio, Envoy) Basic Envoy usage, xDS concepts and usage, and the relationship between ADS and Istio Pilot
• Istio solution | Google Cloud
• What is Istio? | Google Cloud
• Understanding Istio architecture and features
• What is Istio? - South Korea | IBM
• What is Istio?
• (Architecture) MSA : Getting a grip on Istio concepts - Azderica
• Let's learn about Service Mesh Architecture & Istio - Horollihan Haru

References