Client  Gateway  VirtualService  DestinationRule  Service

(routing) (policies) (pods)

Templates

Template 1: Basic Routing

apiVersion: networking.istio.io/v1beta1

kind: VirtualService

metadata:

name: reviews-route

namespace: bookinfo

spec:

hosts:

- reviews

http:

- match:

- headers:

end-user:

exact: jason

route:

- destination:

host: reviews

subset: v2

- route:

- destination:

host: reviews

subset: v1

---

apiVersion: networking.istio.io/v1beta1

kind: DestinationRule

metadata:

name: reviews-destination

namespace: bookinfo

spec:

host: reviews

subsets:

- name: v1

labels:

version: v1

- name: v2

labels:

version: v2

- name: v3

labels:

version: v3

Template 2: Canary Deployment

apiVersion: networking.istio.io/v1beta1

kind: VirtualService

metadata:

name: my-service-canary

spec:

hosts:

- my-service

http:

- route:

- destination:

host: my-service

subset: stable

weight: 90

- destination:

host: my-service

subset: canary

weight: 10

---

apiVersion: networking.istio.io/v1beta1

kind: DestinationRule

metadata:

name: my-service-dr

spec:

host: my-service

trafficPolicy:

connectionPool:

tcp:

maxConnections: 100

http:

h2UpgradePolicy: UPGRADE

http1MaxPendingRequests: 100

http2MaxRequests: 1000

subsets:

- name: stable

labels:

version: stable

- name: canary

labels:

version: canary

Template 3: Circuit Breaker

apiVersion: networking.istio.io/v1beta1

kind: DestinationRule

metadata:

name: circuit-breaker

spec:

host: my-service

trafficPolicy:

connectionPool:

tcp:

maxConnections: 100

http:

http1MaxPendingRequests: 100

http2MaxRequests: 1000

maxRequestsPerConnection: 10

maxRetries: 3

outlierDetection:

consecutive5xxErrors: 5

interval: 30s

baseEjectionTime: 30s

maxEjectionPercent: 50

minHealthPercent: 30

Template 4: Retry and Timeout

apiVersion: networking.istio.io/v1beta1

kind: VirtualService

metadata:

name: ratings-retry

spec:

hosts:

- ratings

http:

- route:

- destination:

host: ratings

timeout: 10s

retries:

attempts: 3

perTryTimeout: 3s

retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503

retryRemoteLocalities: true

Template 5: Traffic Mirroring

apiVersion: networking.istio.io/v1beta1

kind: VirtualService

metadata:

name: mirror-traffic

spec:

hosts:

- my-service

http:

- route:

- destination:

host: my-service

subset: v1

mirror:

host: my-service

subset: v2

mirrorPercentage:

value: 100.0

Template 6: Fault Injection

apiVersion: networking.istio.io/v1beta1

kind: VirtualService

metadata:

name: fault-injection

spec:

hosts:

- ratings

http:

- fault:

delay:

percentage:

value: 10

fixedDelay: 5s

abort:

percentage:

value: 5

httpStatus: 503

route:

- destination:

host: ratings

Template 7: Ingress Gateway

apiVersion: networking.istio.io/v1beta1

kind: Gateway

metadata:

name: my-gateway

spec:

selector:

istio: ingressgateway

servers:

- port:

number: 443

name: https

protocol: HTTPS

tls:

mode: SIMPLE

credentialName: my-tls-secret

hosts:

- "*.example.com"

---

apiVersion: networking.istio.io/v1beta1

kind: VirtualService

metadata:

name: my-vs

spec:

hosts:

- "api.example.com"

gateways:

- my-gateway

http:

- match:

- uri:

prefix: /api/v1

route:

- destination:

host: api-service

port:

number: 8080

Load Balancing Strategies

apiVersion: networking.istio.io/v1beta1

kind: DestinationRule

metadata:

name: load-balancing

spec:

host: my-service

trafficPolicy:

loadBalancer:

simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH

---

Consistent hashing for sticky sessions

apiVersion: networking.istio.io/v1beta1

kind: DestinationRule

metadata:

name: sticky-sessions

spec:

host: my-service

trafficPolicy:

loadBalancer:

consistentHash:

httpHeaderName: x-user-id

# or: httpCookie, useSourceIp, httpQueryParameterName

Best Practices

Do's

• Start simple - Add complexity incrementally
• Use subsets - Version your services clearly
• Set timeouts - Always configure reasonable timeouts
• Enable retries - But with backoff and limits
• Monitor - Use Kiali and Jaeger for visibility

Don'ts

• Don't over-retry - Can cause cascading failures
• Don't ignore outlier detection - Enable circuit breakers
• Don't mirror to production - Mirror to test environments
• Don't skip canary - Test with small traffic percentage first

Debugging Commands

Check VirtualService configuration

istioctl analyze

View effective routes

istioctl proxy-config routes deploy/my-app -o json

Check endpoint discovery

istioctl proxy-config endpoints deploy/my-app

Debug traffic

istioctl proxy-config log deploy/my-app --level debug