Navigating the Maze of Multi-Cluster Istio: Lessons Learned at Scale
summary
Real-world deployment notes for a hub-and-spoke Istio mesh that scales to hundreds of clusters and handles millions of requests/day: uses sidecar-based meshes with options for multi-primary control planes to reduce blast radius, warns that remote secrets let control planes read all namespaces, and shows Spire or tying Istio into an existing PKI to manage trust bundles. Practical tooling includes GitOps (Flux/Argo + Helm/Kustomize), Admiral for sync, Prometheus/Grafana plus two probes (east‑west Go client/server and DNS A‑record north‑south) and migration guidance toward ambient.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:05Agenda and Istio multicluster
- 2:28Network model options
- 4:12Control plane models
- 8:48Mesh model choices
- 10:35Mesh identity setup
- 13:05Challenges in deployment
- 15:11Automation with GitOps
- 16:56East-west observability
- 19:23Cross-cluster observability
- 20:51North-south observability
- 22:19Ambient mesh future
related talks
41mService Mesh beyond single clusters
27mSecure Multicluster Istio Configuration Using GitOps...
20mHow to Optimise your Mesh with Istio Sidecar
43mUsing Kubernetes, Spinnaker and Istio to Manage a Multi-cloud Environment
24mRunning Istio in Production as a Small Team of Newbies
43mConfiguration as Data, GitOps and Multi Cluster The Key to Successful Servic
47mMulti-Cloud with Google Anthos and Istio — How to Stop Worrying About Infrastructure
19mPlanning the Zero-Downtime Lifecycle of Your Service Mesh