This guide details a 10-step framework for safely deploying changes to LLM model, prompt, and tokenizer components using canary releases, traffic routing, automated metrics comparison, and instant rollback mechanisms with Kubernetes, Istio, and Prometheus.
GitHub’s nearly eight‑hour outage was caused by a saturated load balancer in its US‑central data center, a mis‑configured auto‑scaling policy that ignored Istio sidecar concurrency limits, and an optimistic retry loop in VS Code that amplified traffic tenfold, prompting emergency mitigations and a staggered recovery.
The article examines how traditional percentage‑based canary releases evolve into fine‑grained, attribute‑driven deployments with session stickiness, automated SLO gating, traffic mirroring, and service‑mesh integration, highlighting five pain points, practical solutions, and the hidden prerequisites for large‑scale systems.
This comprehensive guide explains Istio’s sidecar architecture, traffic management, mutual TLS security, and observability features, then walks through prerequisite checks, installation with istioctl and Helm, sample Bookinfo deployment, advanced configuration, troubleshooting, monitoring, and backup strategies for production‑grade service meshes.
The article explains Service Mesh as a cloud‑native architecture that separates control and data planes, details its sidecar proxies, core components like Istio Pilot and Citadel, and outlines key capabilities such as traffic management, security, observability, and resilience to help exam candidates master the topic.
The article explains how traditional microservice architectures embed network concerns such as time‑outs, retries, circuit breaking, traffic monitoring and mTLS in application code, why this leads to code coupling, upgrade difficulty and duplicated effort, and how Istio’s sidecar‑based service mesh cleanly separates those concerns while providing traffic management, observability and security features.
This article walks through the practical steps for building a production‑grade global multi‑cluster Kubernetes deployment using Istio multi‑primary, east‑west gateways, and Argo Rollouts, covering traffic routing, canary releases, high‑concurrency tuning, observability, data consistency, and operational best practices for large‑scale e‑commerce order services.
A CTO recounts how a six‑year‑old e‑commerce core system was transformed through simultaneous technical and organizational restructuring, detailing the diagnostic findings, the shift to a domain‑driven microservices architecture on Kubernetes and Istio, the execution timeline, and the dramatic improvements in availability, latency, deployment frequency, and team health.
This guide explains why gray (canary) releases are essential for production stability in internet companies, and provides step‑by‑step configurations using Istio’s VirtualService, Gateway, and DestinationRule resources to route traffic by percentage or request headers in a Kubernetes cluster.
After a year of running Istio in production on a 80‑service, 200‑node Kubernetes fleet, we share six painful pitfalls—including unexpected latency, debugging complexity, upgrade nightmares, configuration explosion, compatibility issues, and mTLS challenges—plus practical mitigation steps and guidance on when Istio truly adds value.
The article explains how microservice projects often become cluttered with retry, timeout, circuit‑breaker, TLS, logging and traffic‑splitting code, and shows that delegating these concerns to a Service Mesh such as Istio—combined with Spring Boot 3.4.1 and Gateway API—removes the burden from application code while providing traffic management, security and observability.
This article explores the fundamentals, design patterns, and production‑ready techniques for service discovery and load balancing in microservice architectures, offering code examples, technology comparisons, and practical guidance for robust, scalable systems.
Learn how to replace Envoy's default, limited access log format with a powerful custom configuration using log_format, including JSON output and detailed fields, enabling precise monitoring, tracing, and troubleshooting in modern cloud‑native environments.
This tutorial introduces Envoy Proxy, explains its core building blocks—listeners, routes, clusters, and filters—demonstrates a quick Docker-based setup, and walks through a complete configuration that routes traffic based on URI paths, providing a practical five‑minute overview of service‑mesh fundamentals.
This article explains the concepts, implementation details, configuration steps, typical use cases, performance and security best practices, and future trends of Istio traffic mirroring for safe and controllable traffic replication in cloud‑native environments.
This article explains how Istio secures micro‑service architectures by providing strong identity, fine‑grained access policies, transparent TLS encryption, and comprehensive AAA (authentication, authorization, audit) mechanisms, covering high‑level architecture, certificate management, peer and request authentication, and authorization policy design.
This guide explains how to upgrade a Kubernetes cluster from v1.30.0 to v1.30.1 without service interruption by backing up etcd, checking health, planning the rollout, upgrading master nodes and Calico, and using rolling updates and Istio canary releases for seamless application migration.
This step‑by‑step guide walks you through AWS EKS core concepts, cluster provisioning with eksctl, kubectl configuration, node monitoring, taints and tolerations, GitLab deployment via Helm, persistent storage with EBS, optional object storage, Istio service‑mesh installation, and troubleshooting API server access issues.
This guide explains why an Istio Ingress Gateway on AWS EKS often remains in EXTERNAL-IP pending state, analyzes root causes such as subnet tags, IAM permissions, and resource quotas, and provides step‑by‑step remediation to get a functional load balancer.
This article explains how Istio's sidecar proxy uses Envoy, iptables rules, and the xDS API to intercept and redirect traffic between Kubernetes pods, detailing the startup injection, traffic hijacking process, and how configuration is dynamically generated by istiod.
This guide walks through a complete Kubernetes DevOps case study, detailing how to containerize micro‑services, create Docker images, write deployment and service manifests, set up a CI/CD pipeline with Jenkins or GitLab CI, integrate monitoring with Prometheus‑Grafana, manage logs via ELK/EFK, optionally add a service mesh, and perform fault‑injection testing for continuous optimization.
Facing thousands of heterogeneous gateway configurations across multiple tech stacks, a Chinese cloud‑native platform consolidated its gateway layer by adopting Higress, Istio CRD, and APISIX, introducing a two‑tier rule model and automated migration tools that cut maintenance effort by 90% while preserving service continuity.
This article explains the relationship between API gateways and service meshes, compares exposure methods, and provides a detailed, step‑by‑step guide for exposing services inside an Istio mesh using an Nginx Ingress Controller, including required annotations and configuration details.
This article explains how to handle intermittent 5xx errors and request timeouts in complex internet services using Istio service mesh, covering system availability levels, retry mechanisms, timeout settings, and concrete VirtualService configurations to improve reliability and user experience.
This guide explains how to implement full‑link gray release using Alibaba Service Mesh (ASM) swimlane isolation together with the open‑source Kruise Rollout framework, providing step‑by‑step configurations, Kubernetes manifests, and command‑line examples for traffic routing, canary deployments, and rollback in a cloud‑native environment.
This article shares practical guidance on rolling out Istio service mesh to over ten business lines, covering selection of pilot projects, benefit analysis using access logs, sidecar injection, performance and resource impact, multi‑region active‑active architecture benefits, and rapid fault‑recovery tactics.
This article explains how Service Mesh can use traffic coloring to route requests based on headers, cookies, or query parameters, enabling safe canary releases, diversified version testing, and isolated QA environments in complex production systems.
This tutorial walks you through connecting a test machine, downloading and installing Istio 1.8.6, configuring environment variables, deploying the BookInfo sample application, verifying pods and services, setting up inbound traffic, exposing dashboards, and introduces Istio’s core traffic‑management capabilities.
This article explains the fundamentals of Service Mesh and Istio, covering their architecture, control‑plane and data‑plane components, deployment modes, key capabilities such as traffic control and security, and the interaction workflow that enables modern cloud‑native microservice environments.
This article explains the challenges of microservice architectures, introduces service mesh concepts, and provides an English overview of Istio’s core components and functionalities such as traffic management, security, observability, and policy enforcement for modern cloud-native applications.
Discover how Istio secures microservices with comprehensive authentication, authorization, and mutual TLS features, covering concepts, architecture, identity management, policy configuration, permissive mode, and practical YAML examples to protect services, data, and communication across any deployment environment.
This article explains how Istio provides comprehensive security for microservices by using traffic encryption, flexible access control, TLS, mutual authentication, JWT request validation, and fine‑grained authorization policies, enabling zero‑trust networking across Kubernetes and other environments.
This guide walks you through using istioctl to inspect mesh status, retrieve proxy configurations, debug Envoy listeners, routes, clusters, and endpoints, validate mutual TLS policies, analyze configuration errors, and leverage component introspection tools for effective Istio service‑mesh operations.
This article explains what Istio and its sidecar proxy are, how they are injected into Kubernetes pods, the iptables rules they use to hijack traffic, the xDS APIs that drive dynamic configuration, and how to inspect the resulting Envoy settings.
This article introduces Istio as a cloud-native service mesh, outlines its core features—traffic management, policy control, observability, and security—compares it with Spring Cloud, and explains its data-plane and control-plane architecture, including the sidecar deployment model.
This article provides a comprehensive overview of Istio, explaining its role as an open‑source service mesh for cloud‑native microservices, detailing the data plane and control plane components, sidecar proxy functions, traffic management, security, and monitoring while also promoting related learning resources.
This article provides a detailed, English-language overview of Service Mesh, explaining its role in cloud‑native microservice architectures, the need for it, its core principles—including data and control planes—and key Istio components, while also offering promotional links to related resources.
This article explains the concept of Service Mesh, its sidecar architecture, and why it’s essential for cloud‑native microservices, then compares leading implementations such as Istio, Linkerd, and Envoy, highlighting their features and deployment models.
This guide explains how to configure Istio locality‑based load balancing and failover across Kubernetes zones and regions, providing hands‑on scripts, YAML examples, and validation steps to ensure resilient microservice traffic routing in cloud‑native environments.
This article explains the relationship between API gateways and service meshes, compares four methods for exposing services inside an Istio mesh, and provides a step‑by‑step guide to using Nginx Ingress Controller as the mesh entry point.
This guide explains why distributed tracing is needed, how Istio uses Jaeger as the tracing backend, the required request‑header propagation, step‑by‑step deployment of Jaeger and the Bookinfo demo on Kubernetes, and how to inspect and interpret the generated spans.
This article explains how to use Istio’s sourceLabels feature to achieve full‑chain gray deployments across multiple microservice versions, providing detailed configuration examples, deployment steps, testing procedures, and an analysis of its advantages and limitations.
This guide explains why multi‑cluster deployments are needed for high‑availability, describes Istio's flat and non‑flat network models with single or multiple control planes, and provides step‑by‑step scripts to create Kind clusters, install MetalLB, configure root CAs, deploy Istio, set up gateways, and verify regional load balancing and failover.
This article details how to transition a Dubbo 3.0 microservice architecture to an Istio service mesh on Kubernetes, covering code modifications, deployment configurations, sidecar injection, traffic management policies, and verification steps with practical YAML examples and log analysis.
This article explains how Istio automatically injects sidecar containers into Kubernetes pods, the iptables‑based traffic interception mechanism for inbound and outbound flows, and how to configure rules to exclude specific traffic from Envoy processing.
This article describes how to use Istio Service Mesh, Kubernetes CRDs, and custom WASM Envoy filters to create isolated swim‑lane call chains that prevent branch conflicts, enable full‑link header propagation, and support features such as Java remote debugging, middleware deployment, and hot code reload.
This article explains why keeping the client source IP in an Istio service mesh matters, outlines the reasons for IP loss, and provides step‑by‑step solutions for north‑south and east‑west traffic using Service settings, traffic policies, and Envoy headers.
This guide walks through Istio's observability stack, showing how to configure Prometheus for metrics collection, deploy Jaeger for distributed tracing, and set up Kiali for visualizing the service mesh, while covering annotations, TLS settings, weighted routing, and configuration validation.
This tutorial explains the newly GA Kubernetes Gateway API, its core resources, and how to set up a test environment with K3s and Istio to create GatewayClass, Gateway, and HTTPRoute objects, demonstrating end‑to‑end traffic routing to a sample Nginx service.
This article explains how cloud‑native service mesh (Istio) can be used for service governance, detailing both local and global rate‑limiting implementations and circuit‑breaking strategies, and provides practical EnvoyFilter and DestinationRule configurations used in the Autohome migration.
This article explains why Istio runs on Kubernetes, compares their roles in cloud‑native architectures, details how Istio extends Kubernetes with Envoy sidecars and xDS, and examines traffic management, load balancing, and the advantages and drawbacks of using a service mesh alongside kube‑proxy.
This guide walks through installing the open‑source JumpServer bastion host on a Kubernetes cluster using Helm, configuring external MySQL and Redis databases, customizing Helm values, and exposing the web UI through an Istio gateway for secure access.
This article introduces OpenStack’s core components, outlines its strengths and weaknesses, and provides step‑by‑step code examples for achieving traffic mirroring and cross‑host forwarding using Kubernetes, Istio, and OpenStack networking plugins such as Neutron and Calico.
The article by delphisfang offers a concise, step‑by‑step guide to mastering Istio’s locality‑aware routing, explaining the three‑evidence learning method, the priority algorithm, required DestinationRule and outlier detection settings, how Envoy discovers locality, and tips for simplifying the Pilot‑Envoy mesh architecture.
To upgrade an Istio service mesh without overloading the cluster or causing downtime, the author recommends using Kubernetes’s built‑in kubectl rollout restart for each deployment—scaling replicas up then deleting old pods or simply invoking the command in a scripted loop—to safely perform a rolling restart of all sidecar‑proxied pods.
This article provides a step‑by‑step technical walkthrough of Istio Ambient Mesh traffic flow, detailing how a curl request from a sleep pod on Node‑A reaches an httpbin pod on Node‑B via iptables, policy routing, ztunnel and waypoint components, complete with code snippets and diagrams.
Kruise Rollout introduces a Lua‑script based, extensible traffic routing solution that enables progressive delivery across diverse gateway resources—such as Istio, Kong, and APISIX—by dynamically modifying VirtualService and DestinationRule objects, simplifying configuration, reducing custom code, and supporting automated canary, blue‑green, and A/B testing deployments.
The article analyzes how private keys for workloads uploaded via Istio Ingress gateways can be exposed in plaintext, stored in memory, and extracted using tools like OpenSSL and GDB, and discusses mitigation strategies such as Intel SGX‑based protection.
Developers and architects can compare Apache Dubbo, Spring Cloud, gRPC, and Istio across architecture, performance, scalability, and governance, gaining clear guidance on selecting the right micro‑service framework and understanding each tool’s strengths, protocol support, and integration patterns for enterprise‑grade cloud‑native applications.
Aeraki Mesh 1.4.0 (codename Heshun) released on August 13, 2023 adds Istio 1.18.x compatibility, removes Envoy Dubbo/Thrift filters, introduces extensive changelog updates, lists contributors from major tech firms, and provides reference links to the official site and GitHub repository.
This article explains the evolution of service mesh data planes from traditional sidecar proxies to the ambient mesh model, detailing L4/L7 split, eBPF acceleration, Waypoint proxies, CNI and Geneve tunnel configurations, and the resulting end‑to‑end traffic flow in Kubernetes clusters.
This article provides a comprehensive guide to Kubernetes Gateway API, covering its evolution from Ingress, core concepts, resource types, configuration examples, role‑based design, cross‑namespace routing, and practical steps for installation, deployment, and management using Istio and other controllers.
This article explains how microservice traffic can be controlled and routed using Istio’s Service‑Mesh features—covering concepts such as header‑based routing, traffic splitting, canary releases, A/B testing, and traffic shading—along with practical YAML examples and Kubernetes deployment details.
This article explains the difficulties of performing gray releases in microservice architectures and presents full‑link gray release concepts, two implementation strategies—environment isolation and traffic routing—along with practical solutions using Istio, service‑discovery agents, tracing baggage, and Alibaba Cloud MSE integrated with ZadigX.
Aeraki Mesh 1.3.0 (code‑named Dragonboat) adds Istio 1.16.x compatibility, introduces connection multiplexing, enables MetaProtocol routing on gateways, expands Dubbo service governance options, provides Redis traffic management, and migrates official images to GitHub Packages, with a detailed changelog and configuration examples.
This article explains how eBPF can replace iptables for traffic redirection in Istio's ambient mesh, describing the implementation details, installation steps, performance benefits, and considerations for choosing between eBPF and traditional iptables approaches.
This article details the collaborative effort between Intel and F5 to redesign and implement dual‑stack networking support in Istio 1.17, covering the background challenges, new RFC design, key Envoy changes, step‑by‑step experimental setup, listener and endpoint modifications, and ways for the community to contribute.
This article explores essential microservice traffic management techniques—including canary releases, A/B testing, and traffic shading—detailing their value, implementation steps, and practical examples using Service Mesh and Istio, with code snippets and diagrams to illustrate routing based on request attributes.
This article details the evolution of 58 Tongcheng's deep learning inference platform—from the initial WPAI‑based architecture to a cloud‑native, Istio‑powered design—covering its background, technical challenges, architectural redesign, traffic‑management features, adaptive rate limiting, model warm‑up, and observability improvements.
The article outlines Ctrip’s microservice journey from its 2013 inception, detailing the evolution of its frameworks, the complexities of operating multiple stacks, the challenges faced, and the design of a progressive cloud‑native service‑mesh architecture built on Istio, Envoy, and custom operators.
This article details the evolution of 58.com’s deep learning inference platform, describing the transition from the original SCF‑based architecture to a cloud‑native Istio gateway (architecture 2.0), and explains design choices, traffic‑management, adaptive rate‑limiting, observability, model pre‑warming, and performance improvements.
This article explains Istio’s core networking concepts, detailing how sidecar and init containers are injected into a Kubernetes cluster, the roles of the data and control planes, and provides step‑by‑step commands and YAML examples for manual and automatic sidecar injection.
This article introduces Service Mesh fundamentals, traces its evolution to Istio, explains the Proxyless Mesh architecture that eliminates sidecar proxies, and provides a step‑by‑step Spring Cloud demo showing how to enable xDS‑based, sidecar‑free communication across multi‑language microservices on Alibaba Cloud MSE.
This tutorial explains the background of the Kubernetes Gateway API, compares it with the traditional Ingress API, and provides a hands‑on walkthrough for installing the Gateway API CRDs, configuring Istio to use a Gateway resource, exposing a sample httpbin service, updating routes, and cleaning up the environment.
This article walks through building, compiling, containerizing, and deploying a simple mock‑response Wasm plugin for Higress on a Kubernetes cluster, explaining the code structure, configuration, plugin lifecycle, and the three revolutionary features of Wasm‑based gateway extensions.
Google donated Istio to the CNCF, which was accepted as an incubating project, introducing the experimental Ambient Mesh mode while retaining sidecar support, and the article outlines Istio's architecture, history, community contributions, and industry perspectives on this cloud‑native milestone.
Istio's ambient mesh introduces a shared‑node ztunnel and optional waypoint proxies to provide zero‑trust security and optional L7 features without sidecar injection, reducing invasiveness, resource waste, and operational complexity while maintaining full mesh functionality.
The article compares monolithic, clustered, and distributed architectures, examines the differences between Spring Cloud, Kubernetes, and Istio, discusses Spring Boot on K8s, and explains the benefits of Service Mesh and sidecar proxies for modern microservice deployments.
This article systematically explains enterprise‑level microservice governance and development, covering market‑driven challenges, evaluation criteria, a comparison of Dubbo, Spring Cloud, and Istio, and design principles such as Conway's Law to help organizations modernize their applications efficiently.
This article outlines a detailed cloud‑native curriculum covering why to learn cloud‑native technologies, the importance of Kubernetes, and a step‑by‑step series of lessons on Go language features, Docker core concepts, Kubernetes architecture, lifecycle management, Istio traffic control, multi‑cluster federation, security guarantees, and a microservices deployment case study.
An extensive cloud‑native curriculum outlines a systematic learning path that combines foundational theory and hands‑on practice across ten chapters, covering Go language fundamentals, Docker core technologies, Kubernetes architecture, lifecycle management, Istio traffic control, multi‑cluster federation, security, and a microservices deployment case study.
The article explains how Intuit manages hundreds of Kubernetes clusters using multi‑control‑plane architectures and Admiral to automate Istio service‑mesh configuration, illustrating the challenges of large‑scale microservice deployment and sharing a domestic bank’s experience with similar cloud‑native adoption.
This article explores modern service governance in the microservice era, comparing traditional sidecar‑based Service Mesh solutions like Istio with emerging eBPF‑driven meshes and RSocket Broker architectures, highlighting their design, performance, operational, and security trade‑offs.
This guide explains how to connect Dubbo services to Aeraki Mesh using Dubbo2Istio or direct ServiceEntry definitions, covering configuration, environment variables, Kubernetes deployment, and client adjustments to achieve comprehensive L7 traffic routing, load balancing, and rate limiting within an Istio service mesh.
This tutorial demonstrates how to install Aeraki and Istio, deploy Dubbo sample services, define ServiceEntry and MetaRouter resources, route traffic to a primary version, mirror traffic to a secondary version, verify logs, and explain the underlying MetaProtocol proxy mechanism for traffic mirroring.
This tutorial explains how to create a custom seven‑layer protocol for a service mesh by leveraging Aeraki Mesh and MetaProtocol Proxy, covering codec implementation, workspace configuration, compilation steps, and Kubernetes/Istio resources to enable traffic management for protocols like Dubbo and Thrift.
The article examines the evolution from monolithic to distributed systems, contrasts Spring Cloud with Kubernetes and Istio, explains how service‑mesh concepts like sidecar proxies decouple business logic from infrastructure, and discusses migration paths and the advantages of non‑intrusive, language‑agnostic platforms.
This tutorial walks through installing Aeraki Mesh and sample Dubbo/Thrift services, creating a MetaRouter resource to add custom request headers, verifying the changes via sidecar logs, and explains how Aeraki translates MetaRouter rules into MetaProtocol Proxy configurations delivered through its internal RDS server.
This tutorial demonstrates how to install Aeraki Mesh, view its default Round Robin load balancing, and configure a Consistent Hash algorithm for Dubbo services using Istio DestinationRule metadata, then verifies the behavior and explains the underlying RDS routing configuration.
This tutorial walks through installing Aeraki Mesh and Istio on Kubernetes, deploying a fake Thrift service, configuring an Istio DestinationRule for outlier detection, and verifying that failed endpoints are automatically ejected to prevent cascade failures.
This tutorial explains how to set up Aeraki Mesh's global rate limiting for Dubbo and Thrift services in an Istio service mesh, covering the deployment of a rate‑limit server, configuration of rate‑limit rules, enabling limits via MetaRouter, and verifying the behavior with command‑line tools.
This tutorial demonstrates how to install Aeraki Mesh, use its MetaRouter CRD to configure local rate limiting for MetaProtocol services such as Dubbo and Thrift, apply per‑service and conditional limits, and view the generated sidecar proxy configuration in a Kubernetes environment.
The article examines the evolution from monolithic to distributed architectures, compares Spring Cloud, Kubernetes, and Istio, explains how service mesh and sidecar proxies enable language‑agnostic microservices, and argues that Kubernetes‑based solutions increasingly surpass Spring Cloud in flexibility, scalability, and operational independence.
This article details Ctrip's large‑scale Service Mesh deployment using Istio, analyzes control‑plane performance bottlenecks such as pilot concurrency and configuration push latency, and presents a series of optimizations—including namespace isolation, concurrent ServiceEntry processing, incremental EnvoyFilter handling, and pilot configuration tweaks—that dramatically improve init‑context and push times while supporting thousands of services.
This tutorial explains the fundamentals of service mesh, outlines Istio's architecture and core components, walks through installing Istio on Kubernetes, demonstrates a sample microservice deployment with traffic‑management, security, and observability features, and discusses when to adopt a service mesh and its alternatives.
This tutorial explains the fundamentals of service mesh, details Istio’s architecture and core components, demonstrates how to install and configure Istio on Kubernetes, and explores common use cases such as traffic management, security, observability, and alternatives.
The first Cloud‑Native Practitioners Conference brought together engineers from Zuoyebang, Zhihu, Zhuanzhuan and others to share large‑scale Kubernetes, serverless and Istio experiences, industry trends, and practical solutions that drive stability, efficiency and digital transformation.
This tutorial demonstrates how to install Aeraki Mesh, use its MetaRouter CRD to achieve request‑level load balancing, attribute‑based routing, and weighted traffic splitting for Dubbo and Thrift services in an Istio service mesh, including the underlying configuration principles and example commands.
This article introduces Aeraki Mesh, a CNCF sandbox project that extends Istio by providing a non‑intrusive, scalable framework to manage traffic for any layer‑7 protocol—including Dubbo, Thrift, Redis, and Kafka—through its MetaProtocol architecture and dynamic routing capabilities.
This article explains how to replace Spring Cloud with Istio by creating a simple Spring Boot microservice that uses gRPC for communication, packaging it with Docker, deploying it on Kubernetes, and exposing it through an Istio gateway, complete with code examples and deployment instructions.
