Kubernetes Service Mesh Guide — Istio, Linkerd, and Traffic Management

# Download Istio
curl -L https://istio.io/downloadIstio | sh -
cd istio-*

# Install with default profile
istioctl install --set profile=default -y

# Enable sidecar injection on a namespace
kubectl label namespace default istio-injection=enabled

# Verify
kubectl get pods -n istio-system

# virtual-service.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            end-user:
              exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

# Apply routing rules
kubectl apply -f virtual-service.yaml

# Test routing
kubectl exec deploy/sleep -- curl -s http://reviews/ | head -2

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: canary-rollout
spec:
  hosts:
    - myapp
  http:
    - route:
        - destination:
            host: myapp
            subset: stable
          weight: 90
        - destination:
            host: myapp
            subset: canary
          weight: 10

# mTLS enforcement
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT  # STRICT, PERMISSIVE, DISABLE
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: permissive-ns
spec:
  mtls:
    mode: PERMISSIVE  # Allow plaintext too (migration)

# Verify mTLS
istioctl authn tls-check <pod-name>.<namespace>

# telemetry.yaml
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  accessLogging:
    - providers:
        - name: envoy
  metrics:
    - providers:
        - name: prometheus
  tracing:
    - providers:
        - name: zipkin

import requests
import time

class ServiceMeshClient:
    def __init__(self, base_url: str):
        self.base_url = base_url

    def call_service(self, path: str, headers: dict = None) -> dict:
        start = time.time()
        resp = requests.get(
            f"{self.base_url}{path}",
            headers=headers or {},
            timeout=5
        )
        duration = (time.time() - start) * 1000

        # Envoy adds these headers
        trace_info = {
            "x-request-id": resp.headers.get("x-request-id"),
            "x-envoy-upstream-service-time": resp.headers.get(
                "x-envoy-upstream-service-time"
            ),
            "x-b3-traceid": resp.headers.get("x-b3-traceid"),
            "x-b3-spanid": resp.headers.get("x-b3-spanid"),
        }

        return {
            "status": resp.status_code,
            "duration_ms": round(duration, 2),
            "trace": trace_info,
            "body": resp.text[:100]
        }

client = ServiceMeshClient("http://myapp.default.svc.cluster.local")
result = client.call_service("/api/v1/products")
print(f"Status: {result['status']}")
print(f"Duration: {result['duration_ms']}ms")
print(f"Trace ID: {result['trace']['x-b3-traceid']}")
print(f"Envoy time: {result['trace']['x-envoy-upstream-service-time']}ms")

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: circuit-breaker
spec:
  host: backend-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 50
        maxRequestsPerConnection: 10
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 60s
      maxEjectionPercent: 50

# Install Linkerd CLI
curl -sL https://run.linkerd.io/install | sh

# Install Linkerd on cluster
linkerd install | kubectl apply -f -

# Verify
linkerd check

# Inject sidecars into a namespace
kubectl get deploy -n default -o yaml | linkerd inject - | kubectl apply -f -

import random
import time
from collections import defaultdict

class ServiceMeshAnalytics:
    def __init__(self):
        self.requests = []
        self.circuit_breaker_states = defaultdict(bool)

    def record_request(self, source: str, target: str,
                       latency_ms: float, status: int):
        self.requests.append({
            "source": source,
            "target": target,
            "latency": latency_ms,
            "status": status,
            "time": time.time()
        })

    def success_rate(self, service: str = None) -> float:
        relevant = self.requests
        if service:
            relevant = [r for r in self.requests if r["target"] == service]
        if not relevant:
            return 1.0
        successes = sum(1 for r in relevant if r["status"] < 500)
        return successes / len(relevant)

    def p99_latency(self, service: str = None) -> float:
        relevant = self.requests
        if service:
            relevant = [r for r in self.requests if r["target"] == service]
        if not relevant:
            return 0.0
        sorted_lat = sorted(r["latency"] for r in relevant)
        idx = int(len(sorted_lat) * 0.99)
        return sorted_lat[idx]

    def circuit_breaker_health(self, service: str) -> str:
        failures = sum(
            1 for r in self.requests
            if r["target"] == service and r["status"] >= 500
        )
        total = sum(
            1 for r in self.requests if r["target"] == service
        )
        if total > 10 and failures / total > 0.5:
            return "OPEN (circuit breaker tripped)"
        elif failures > 0:
            return f"HALF-OPEN ({failures} recent failures)"
        return "CLOSED (healthy)"

analytics = ServiceMeshAnalytics()
services = ["frontend", "reviews", "ratings", "details"]

for _ in range(1000):
    src = random.choice(services)
    dst = random.choice([s for s in services if s != src])
    lat = random.gauss(20, 5) if random.random() > 0.1 else random.gauss(500, 100)
    status = 200 if random.random() > 0.05 else 500
    analytics.record_request(src, dst, lat, status)

for svc in services:
    sr = analytics.success_rate(svc) * 100
    p99 = analytics.p99_latency(svc)
    cb = analytics.circuit_breaker_health(svc)
    print(f"{svc:>10}: SR={sr:.1f}% P99={p99:.0f}ms CB={cb}")