Istio puts a shared layer around communication between application services. It can manage traffic rules, service identity, connection security and monitoring without each application implementing all of those functions itself. Teams use it when those cross-service requirements justify operating a service mesh. Its sidecar and ambient modes place the traffic-handling components differently, so the mode must be chosen around the policies and protocols the applications actually need.
Current guidance
Current upstream guidance distinguishes sidecar mode, where an Envoy proxy accompanies each workload, from ambient mode, which uses a node-level Layer 4 proxy and optional waypoint proxies for Layer 7 features. The historical chart and sidecar-only description do not cover that choice.
Select the mode around the policies and traffic features required by the application. Ambient encryption and Layer 4 authorization do not make every HTTP authorization rule or routing feature active without a waypoint. The upstream comparison also identifies unsupported extensions, including EnvoyFilter in ambient mode; inventory such dependencies before migration.
Roll out to a bounded namespace and verify workload identity, allowed and denied requests, telemetry and service-to-service behavior. Check how traffic reaches the mesh, and how excluded workloads or protocols are handled. Upgrade the control plane and data-plane components according to the selected release’s instructions, with a rollback plan for policy changes. This guidance is a source review of architecture and migration constraints, not a measured overhead result or a claim that either mode fits every topology.
Historical upstream link check · 2026-10-09
The recorded upstream address redirects to https://istio.io/latest/about/service-mesh/ and returned HTTP 200 on 2026-10-09. Link availability does not certify the historical installation instructions or current security support.
Website availability is separate from project, chart and image support. Use the current guidance and primary sources on this page to assess the distribution.
Historical Kubedex content
Original publication: 2018-09-08T08:02:02+00:00. Preserved for context. Commands, versions, prices and results below reflect the original research.
Istio is an open platform that provides a uniform way to connect, manage, and secure microservices. Istio supports managing traffic flows between microservices, enforcing access policies, and aggregating telemetry data, all without requiring changes to the microservice code. This chart bootstraps a Istio deployment on a Kubernetes cluster using the Helm package manager.
You may be interested in our service mesh comparison article.
Why use Istio?
Istio makes it easy to create a network of deployed services with load balancing, service-to-service authentication, monitoring, and more, without any changes in service code. You add Istio support to services by deploying a special sidecar proxy throughout your environment that intercepts all network communication between microservices, then configure and manage Istio using its control plane functionality, which includes:
- Automatic load balancing for HTTP, gRPC, WebSocket, and TCP traffic.
- Fine-grained control of traffic behavior with rich routing rules, retries, failovers, and fault injection.
- A pluggable policy layer and configuration API supporting access controls, rate limits and quotas.
- Automatic metrics, logs, and traces for all traffic within a cluster, including cluster ingress and egress.
- Secure service-to-service communication in a cluster with strong identity-based authentication and authorization.
- Istio is designed for extensibility and meets diverse deployment needs.
Core features
Istio provides a number of key capabilities uniformly across a network of services:
Traffic management
Istio’s easy rules configuration and traffic routing lets you control the flow of traffic and API calls between services. Istio simplifies configuration of service-level properties like circuit breakers, timeouts, and retries, and makes it a breeze to set up important tasks like A/B testing, canary rollouts, and staged rollouts with percentage-based traffic splits.
With better visibility into your traffic, and out-of-box failure recovery features, you can catch issues before they cause problems, making calls more reliable, and your network more robust – no matter what conditions you face.
Security
Istio’s security capabilities free developers to focus on security at the application level. Istio provides the underlying secure communication channel, and manages authentication, authorization, and encryption of service communication at scale. With Istio, service communications are secured by default, letting you enforce policies consistently across diverse protocols and runtimes – all with little or no application changes.
While Istio is platform independent, using it with Kubernetes (or infrastructure) network policies, the benefits are even greater, including the ability to secure pod-to-pod or service-to-service communication at the network and application layers.
Observability
Istio’s robust tracing, monitoring, and logging give you deep insights into your service mesh deployment. Gain a real understanding of how service performance impacts things upstream and downstream with Istio’s monitoring features, while its custom dashboards provide visibility into the performance of all your services and let you see how that performance is affecting your other processes.
Istio’s Mixer component is responsible for policy controls and telemetry collection. It provides backend abstraction and intermediation, insulating the rest of Istio from the implementation details of individual infrastructure backends, and giving operators fine-grained control over all interactions between the mesh and infrastructure backends.
All these features let you more effectively set, monitor, and enforce SLOs on services. Of course, the bottom line is that you can detect and fix issues quickly and efficiently.
Platform support
Istio is platform-independent and designed to run in a variety of environments, including those spanning Cloud, on-premise, Kubernetes, Mesos, and more. You can deploy Istio on Kubernetes, or on Nomad with Consul. Istio currently supports:
- Service deployment on Kubernetes
- Services registered with Consul
- Services running on individual virtual machines
Integration and customization
The policy enforcement component of Istio can be extended and customized to integrate with existing solutions for ACLs, logging, monitoring, quotas, auditing, and more.
The post Istio appeared first on kubedex.com.
Sources & further reading
Spotted something that needs another look?
Help improve this page →