Complete Istio Service Mesh (1.8) Masterclass + AWS EKS

Understand how a service mesh uses envoy sidecars and gateway patterns to connect, secure, and manage traffic between pods, with mutual TLS by default and SSL termination.

Consolidating pilot, Citadel, and policy into a single EOD control plane after v1.5 leads to a monolithic design that simplifies installation and maintenance.

Learn why Istio enables traffic management with gateways, virtual services, and advanced routing. Secure service mesh with mutual TLS and JWT-based auth, and observe latency and topology via Kiali.

Create an AWS account, sign in to the console, add an IAM user with programmatic access and a custom password, then generate and securely store access key and secret key.

Install and configure the aws, aws-iam-authenticator, kubectl, and eksctl CLIs using Homebrew on macOS or Chocolatey on Windows, then verify installations and set up access keys and region.

Create an AWS EKS cluster with eksctl, set region and t3.medium workers, configure desired one, min one, max two, enable ssh access, and verify with eks describe cluster.

Install istioctl cli by downloading version 1.6.7, set and export the path, and update the bash profile; reopen a new terminal to load the changes and verify Istio is installed.

Deploy pods and services on the x cluster, expose them via a public load balancer and AWS ELB, and verify a front-end guestbook app with a Redis master/slave setup.

Install Nginx ingress controller using a Helm chart, create a namespace, add the stable Helm repo, update charts, install, verify pods and services, and compare with an ingress gateway setup.

Create an ingress resource YAML to enable layer 7 load balancing by host and path for guestbook service, then apply with kubectl and use the ingress DNS to access it.

Change the guestbook service from a load balancer to a nodeport, remove extraneous metadata, and apply a streamlined yaml to delete the old load balancer and restore access.

Explore how an Istio gateway replaces ingress controllers to expose services at the mesh edge, using a standalone Envoy proxy, virtual service configurations, and edge TLS settings.

Explore gateway YAML anatomy by analyzing gateway definitions, ports, protocols, hosts, and how a virtual service binds to a gateway to route traffic in Istio on AWS EKS.

Learn how virtual service defines routing rules, hosts, and gateways to expose services. See how envoy routes traffic to destination services and enables canary releases and timeouts.

Explore virtual service yaml anatomy, including hosts, destinations, and http routing with condition matching, and learn how global versus route-specific rules, canary deployments, and fqdn naming influence traffic.

Deploy Istio gateway and virtual service to route traffic to the guestbook service, replacing the ingress, configure path prefixes and service name or FQDN, and validate with DNS and curl.

Uninstall the nginx ingress controller with helm, remove its namespace, and clean up remaining ingress resources to ensure the cluster no longer exposes the previous ingress gateway.

Learn to implement weight-based routing (canary/ traffic splitting) with destination rules and virtual services in Istio, defining subsets (v1, v2) and weights, and verify with the dashboard and traces.

Use identity based routing with a virtual service to route end-user tester traffic to reviews v1 and then to BE1, via header match conditions and a preconfigured yaml file.

Configure the Istio virtual service to route traffic by query string parameters and headers, defining match conditions to direct requests to specific subsets.

Configure uri path based routing with a virtual service to direct product page requests to product page v2 or reviews v2 using exact, prefix, or regex matches, with case-insensitive matching.

Inject a 10-second latency delay using a virtual service to test resilience with 100 percent of traffic, affecting the product page, reviews, and ratings flow.

Configure timeouts with a virtual service to cap delays at one second while a ten-second delay exists, revealing per-service timeout precedence and the impact of retries on responses.

demonstrate mirroring live traffic with a virtual service in Istio, routing 100 percent to the primary reviews version while mirroring to a canary version, with header augmentation for traceability.

Configure load balancing policies for pods with destination rules and traffic policies, including round-robin, least connections, and random, at global and subset levels.

Configure rate limiting by adjusting configuration collection settings in the situation room to cap http and tcp connections to the news service, with a 30 ms timeout.

Configure circuit breaker in Istio by enabling outlier detection to eject unhealthy upstream hosts after consecutive errors for an interval, and test with Fortio to observe traffic disruption.

Learn to enable https for multiple domains on a single istio gateway with sni, by issuing certificates, creating secrets, and configuring the gateway and virtual service to serve multiple hosts.

Enable strict mutual TLS for the default namespace, disable the global authentication config, and verify plaintext requests are blocked in that namespace while other namespaces remain unaffected.

Enable strict mutual TLS for a specific workload in a namespace by configuring namespace-scoped peer authentication and a destination for outgoing requests, blocking plaintext while allowing TLS for targeted host.

Enable http redirect to https in the gateway by configuring port 80 to forward to 443, then test the redirect and verify secure headers and certificate handshake.

Enable end-user authentication and authorization with Jason Web token across the gateway by creating a request authentication policy and an authorization policy, then test access with valid and invalid tokens.

Enable end-user authentication with JWT for a specific HTTP path by applying namespace-scoped authorization policies, testing access to /heroes and /headers, and balancing global versus default namespace rules.

Enable end-user authentication with JWT per HTTP path and host by applying authorization policy rules that require a valid JWT token and deny requests without one.

Enable jwt authorization with http header attributes in Istio service mesh, using x-token headers to gate endpoints and test admin versus non-admin access in AWS EKS environments.

Block requests from a specific source IP by creating an explicit deny authorization policy in Istio, retrieving the client IP, applying the policy, and testing the denial.

Explore Istio egress security by comparing three modes—default pass-through, service entries for controlled external DNS access, and direct bypass for specific ranges—focusing on monitoring and traffic control.

Set a custom timeout for external egress calls using Istio service entries and virtual services, demonstrating a three-second limit that can cause a gateway timeout for delayed external responses.