Experiences From Running Istio in a K8s Production Environment
summary
Norwegian welfare runs Istio across on‑prem and GKE clusters to provide mutual TLS and Istio RBAC, expose telemetry to Prometheus/ELK, and hide complexity behind an Application CRD plus a nice operator that generates Kubernetes, Istio and Vault wiring; secrets come from Vault and Rook provides storage. Early Istio (0.5) is unstable, 0.8 works well; kubelet probes break with mTLS so a custom injected nice-proxy envoy handles platform ports as a workaround. Deployment reaches 27 applications on the first production day.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:49The Platform Team
- 8:18Alerts
- 10:47Parameter Based Security
- 18:15Test Out Google Cloud Platform
- 20:35Create a Custom Resource
- 24:51Access Policy
- 25:06Network Policy
- 27:06Challenges
- 27:47Proposed Solutions
- 33:57What's Next
related talks
24mIstio in Production: Expected Value, Results, and Effort
47mIstio on Kubernetes: Chaos, Canaries, Dark Launches
01h 01mMeshing Around with Istio
47mIstio, le meilleur ami de votre cluster K8S
52mMaking microservices micro with Istio Service Mesh & Kubernetes
47mDeploying Service Mesh in Production
40mIstio, your K8S cluster best friend
01h 06mIstio on Kubernetes: Smart Canaries, Dark Launches and Chaos