INTERACTIVE · SERVICE MESH

Istio, Visually: Zero to Hero on the Service Mesh Powering Your Pods

One diagram, ten stages. Watch a checkout-api go from raw pod-to-pod calls to a fully meshed service — istiod configuring Envoy sidecars, a canary via VirtualService, automatic mTLS, free telemetry, and finally ambient mode. Nothing on the canvas moves between stages — only what's lit changes. The frames show where each piece runs: the AWS-managed EKS control plane (kube-apiserver) vs your EC2 worker nodes — note that istiod is Istio's control plane but runs in the EKS data plane. Use Layers to isolate Istio's control plane (istiod) from its data plane (the Envoys).

Istio layers
View
Tip: click any box to jump to its stage

How Istio works, from no mesh to ambient meshA checkout-api and payments service gain Envoy sidecars managed by istiod on EKS: the AWS-managed control plane (kube-apiserver/etcd) holds the Istio config; istiod runs on your EC2 worker nodes (the data plane) and streams config to every Envoy over xDS; requests enter through an AWS NLB to an ingress-gateway node, mTLS is issued automatically, telemetry flows to Kiali/Grafana/Jaeger, and finally sidecars are replaced by ztunnel and waypoint proxies in ambient mode.direct call · no meshforward to gw pod IPv1 · 90%v2 · 10%call paymentswatches config · CAxDS · configmetrics · tracesselectsselectsztunnel interceptsEKS control plane · AWS-managedEKS data plane · your EC2 worker nodesEC2 node · istio-systemEC2 node · ingressEC2 node · app podscheckout-api pod v1 · 10.0.3.11checkout-api pod v2 · 10.0.3.22 (canary)payments pod · 10.0.6.9kube-apiserver / etcdcluster stateall objects (incl. Istio CRs)Istio config · CRs in etcdVirtualService · DestinationRuleGateway · PeerAuthenticationAWS-managed — you don't run thisclientAWS NLBlistener :443forwards to targetsNLB target group10.0.5.11:844310.0.5.12:8443istiodcontrol plane · 10.0.5.20:15012ObservabilityKiali · Grafana · Jaegeringress-gatewayEnvoy pods · 10.0.5.11 / .12Envoysidecarcheckout v1Envoysidecarcheckout v2EnvoysidecarpaymentsService · checkouttype: ClusterIPselects v1 + v2 podsService · paymentstype: ClusterIPselects payments podztunnelper-node proxy · ambient L4waypointambient L7
Legend control plane / Envoy config / xDS your app observability / ambient mTLS installed this step
Stage 1 / 10

    Names are illustrative (the checkout-api/payments thread, v1/v2 subsets, 90/10 canary). Confirm against your own cluster: istioctl proxy-config for what an Envoy actually received, istioctl authn tls-check for mTLS status, and your PeerAuthentication/VirtualService objects. Ambient mode (ztunnel + waypoint) is GA-track and evolving — check the Istio docs for your version.