~/ nmadiraju.com Amazon EKS · Service mesh
arrow_back Back to nmadiraju
Visual Walkthrough · Kubernetes networking

How a Service Mesh Works on Amazon EKS

Follow web's calls to orders and payments as Istio adds proxies, mutual TLS, access rules and traffic control, then check yourself with 8 questions.

1Visual Walkthrough

Pods web, orders and payments on EKS with Envoy sidecars, the Istio control plane istiod, and Istio config objects Namespace shop holds Pods web, orders, payments and payments-v2, each with an app container and, once injected, an Envoy sidecar. Namespace tools holds debug, a Pod with no sidecar. istio-system holds istiod and, as an alternative, ztunnel. On the right, the namespace label, PeerAuthentication, AuthorizationPolicy, VirtualServices and a DestinationRule. The walkthrough shows plaintext calls, injection after a restart, mutual TLS between Envoys, STRICT mode, an authorization policy, retries multiplying across hops, a 90/10 split and the cost of sidecars. Platform team kubectl VPC 10.0.0.0/16 · EKS CLUSTER shop-prod NAMESPACE shop web web :8080 app container orders orders :8080 app container payments payments :8080 app container payments-v2 sa payments · 2/2 payments :8080 app container Envoy Envoy Envoy Envoy NAMESPACE tools debug sa default · 1/1 a Pod with no sidecar, e.g. a job or a debug shell NAMESPACE istio-system istiod · Istio control plane injects sidecars · pushes config to Envoys signs each workload's certificate ztunnel · ambient mode alternative one per node, shared by its Pods: no sidecars KUBERNETES API · ISTIO CONFIG Namespace shop labels: PeerAuthentication namespace shop mtls.mode: STRICT AuthorizationPolicy selector app=payments ALLOW from principal cluster.local/ns/shop/sa/orders VirtualServices DestinationRule payments subset v1: version=v1 subset v2: version=v2

    2Quiz to check understanding

    Check yourself