Modules · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
What a mesh gives
mTLS with workload identity | Encryption + 'who is calling' for every hop |
Authorization policies | Allow service A → B (by identity), not by IP |
Traffic control | Canary splits, retries, timeouts, circuit breaking, fault injection |
Uniform telemetry | Golden signals for every service without code changes |
What it costs
Resources | Proxies per pod (sidecar) or per node (ambient/ztunnel) |
Latency | Extra proxy hops (typically sub-millisecond to a few ms each) |
Operations | Upgrades, certificates, CRDs, debugging a new layer |
Install & inspect
istioctl install --set profile=default (or profile=ambient) | Install Istio (or use the Helm charts) |
kubectl label namespace shop istio-injection=enabled | Sidecar mode: inject into new pods |
kubectl label namespace shop istio.io/dataplane-mode=ambient | Ambient mode: add a namespace to the mesh |
istioctl waypoint apply -n shop --enroll-namespace | Ambient: add an L7 waypoint for the namespace |
istioctl analyze -A | Find configuration problems |
istioctl proxy-status / istioctl proxy-config routes <pod> | Is config pushed? What does this proxy know? |
Core resources
PeerAuthentication / AuthorizationPolicy / RequestAuthentication | mTLS mode, access rules, JWT validation |
VirtualService / DestinationRule (or Gateway API HTTPRoute) | Routing and traffic policy |
ServiceEntry / Sidecar / Telemetry | External services, proxy scope, telemetry config |
Install & check
linkerd check --pre | Validate the cluster before installing |
linkerd install --crds | kubectl apply -f - && linkerd install | kubectl apply -f - | Install CRDs, then the control plane (CLI method) |
linkerd check | Verify the installation |
kubectl annotate ns shop linkerd.io/inject=enabled | Inject proxies into new pods |
linkerd viz install | kubectl apply -f - && linkerd viz dashboard | Metrics extension and dashboard |
Observe & debug
linkerd viz stat deploy -n shop | Success rate, RPS, latency per deployment |
linkerd viz top deploy/cart -n shop | Live top requests |
linkerd viz tap deploy/cart -n shop | Stream live requests (metadata) |
linkerd viz edges deploy -n shop | Which connections are mTLS'd, by identity |
Identity
spiffe://cluster.local/ns/shop/sa/cart | Istio SPIFFE ID (trust domain / namespace / service account) |
cart.shop.serviceaccount.identity.linkerd.cluster.local | Linkerd identity name |
One service account per workload | Identities are only as fine-grained as service accounts |
Istio mTLS & authz
PeerAuthentication mtls.mode: PERMISSIVE → STRICT | Accept both, then only mTLS |
PeerAuthentication in istio-system (root namespace) | Mesh-wide default |
AuthorizationPolicy: from.source.principals: [cluster.local/ns/shop/sa/frontend] | Allow by identity |
istioctl x describe pod <pod> | Effective mTLS/policy for a pod |
Routing
HTTPRoute backendRefs weights: 90 / 10 | Canary split (Gateway API; Istio and Linkerd) |
VirtualService http.route[].weight + DestinationRule subsets | Canary split (Istio API) |
Argo Rollouts / Flagger | Automate canary steps with metric analysis |
Resilience
timeout: 2s (per route) | Never wait forever |
retries: attempts: 2, perTryTimeout: 500ms, retryOn: connect-failure,refused-stream,unavailable | Retry only safe failures |
connectionPool + outlierDetection (DestinationRule) | Circuit breaking and ejecting bad endpoints |
fault: delay / abort (VirtualService) | Inject failures to test behaviour |
Istio metrics
istio_requests_total{reporter, source_workload, destination_workload, response_code} | Request counts |
istio_request_duration_milliseconds_bucket | Latency histogram |
reporter="destination" (server side) vs "source" (client side) | Avoid double counting |
Linkerd & tools
request_total, response_total, response_latency_ms_bucket | Linkerd proxy metrics |
linkerd viz stat / routes / edges | CLI golden signals |
Kiali | Istio service graph, config validation |
Istio revision upgrade
istioctl install --set revision=1-26-0 | Install the new control plane alongside the old |
istioctl tag set prod-stable --revision 1-26-0 --overwrite | Point a stable tag at the new revision |
kubectl label ns shop istio.io/rev=prod-stable --overwrite (remove istio-injection) | Namespaces follow the tag |
kubectl rollout restart deploy -n shop | Move pods to the new sidecar |
istioctl uninstall --revision 1-25-2 | Remove the old control plane when empty |
Linkerd & general
linkerd upgrade | kubectl apply -f - (or helm upgrade) | Upgrade the control plane |
linkerd check --proxy | Check proxies' versions and health |
Upgrade one minor at a time; read release notes | Supported paths |
