Untangling Your Istio Mesh with Feature Gates
summary
Explains how to shrink Istio’s configuration surface by combining Kubernetes admission controllers (validate PeerAuthentication and DestinationRule to enforce global mTLS and block overrides), RBAC limits on sensitive CRDs, and GitOps reconciliation via Flux Helm release to prevent drift; recommends a deny-by-default AuthorizationPolicy, enforces sidecar limits to cut Envoy memory, and bans alpha wasm plugins for production due to high memory cost. Includes using Gatekeeper/Open Policy Agent for Rego policies and CI linting as a shift-left defense.
AI-written summary · about
chapters (14)
- 0:00Istio feature gates intro
- 1:02Istio configurability complexity
- 4:37Feature gates in Istio
- 7:28Admission controllers for guardrails
- 13:51Role-based access control in Istio
- 14:34GitOps for Istio config
- 17:45API abstractions over Istio
- 19:07Whitelisting Istio features
- 22:15Feature maturity and security
- 24:26Monitoring resource impact
- 26:32Aligning features with needs
- 27:39Recap and takeaways
- 29:44Istio community updates
- 31:31Q&A
related talks
55mEmpower Your Microservices with Istio Service Mesh
30mService Mesh Is Still Hard. The Things we all Did Wrong & Tales of Woe
38mFewer Moving Parts: Simplify Service Mesh Operations with Istio Ambient Mesh
50mDeveloping Microservices with Istio
40mReimagining Application Networking and Security
19mPlanning the Zero-Downtime Lifecycle of Your Service Mesh
47mIstio, le meilleur ami de votre cluster K8S
27mService Mess to Service Mesh