Pre-Sail Checks: Do You Need a Checklist Before Sailing to Production with Istio?
summary
Checklist-style prescriptive steps and measurable checks for running Istio in production: verify no orphan sidecars after revisioned upgrades by alerting on Envoy CDS/LDS update time, monitor istiod push metrics and tune PILOT_DEBOUNCE_AFTER and push throttle, run istioctl proxy-config routes on gateways to catch traffic hijacking, enforce annotations via OPA to prevent sidecar bypass, scope sidecar/service entries and use an egress gateway to avoid cross-zone cost and RDS overload, and validate startup ordering to eliminate init-container race conditions. Glue core analyzers automate many of these checks.
AI-written summary · about
chapters (13)
- 0:00Pre-sail checks for Istio
- 3:33Checklists in production
- 4:15Istio readiness checklist
- 4:57Orphaned sidecar problem
- 8:31Missing VirtualServices
- 10:54Traffic hijacking in clusters
- 15:08Cross-zone traffic costs
- 20:44Bypassing Istio sidecars
- 22:09Uncontrolled database access
- 24:16Istio security defense
- 25:59Pod startup race conditions
- 28:11Production checklist guide
- 29:15Q&A
related talks
26mIstio Migration: 50k+ Pods, Minimal Impact, Lessons Learned
42mHow to foster a Culture of Resilience
35mIs My Thing Reliable? Adventures in Driving Consistency of...
28mHow to Get a Service Mesh Into Prod without Getting Fired
30mManaging Kubernetes: What You Need to Know About Day 2 - Craig Tracey, Heptio
28m"TOGA: Checklists and Safety Measures for "Yoloing" in Prod"
46mWhat Comes After Going to Production?
40mPlatform Wars: The Battle Between Golden Paths and Spaghetti Pipelines