Course Overview
This course explains how to use the Istio ServiceMesh for routing and managing network traffic, enforce security and how to observe telemetry.
Who should attend
Teams running (or moving towards) a microservice architecture on Kubernetes who need traffic management, zero-trust security and observability without changing application code.
What you'll learn
- Understand what a service mesh is, and how the sidecar and ambient data planes differ
- Choose between sidecar and ambient mode for a given workload
- Manage and route traffic, including canary-style rollouts
- Secure service-to-service communication with mutual TLS and authorization policies
- Observe your mesh with Istio's telemetry
Course Prerequisites
Students are expected to have basic knowledge of Kubernetes. We advice students to follow our KUBERNETES course. Though not required, it is helpful to have an understanding of Microservice architecture and patterns
Outline
Introduction
- Introduction to a Service Mesh
- Introduce/recap Micro-services Architecture (MSA ) patterns (in particular the sidecar)
- Discuss challenges in a service mesh
- Understand the differences between an Enterprise Service Bus (ESB) and a Service Mesh
- Introduce Istio
- High-level architecture of Istio
- Components of the data plane and control plane
- Introduce the Envoy project and its use in Istio
- Brief overview of installation and configuration techniques (e.g., Istioctl, Helm)
- Install Istio using Istioctl
Traffic Management
- Overview of traffic management with Istio
- Controlling Ingress and Egress traffic
- Configuring Gateways
- Defining Virtual Services
- Understand host and destination bindings
- Controlling HTTP traffic (matching, rewriting, redirecting, …)
- Testing resilience by using declarative faults
- Using Destination rules
- Flowing traffic to different versions (subsets)
- Managing versions using mirroring
- Explicitly adding Service Entries for outside traffic
- Resilience service with Circuit Breakers
Security
- Understand the need for declarative security
- List security tasks (identity, message privacy, message integrity, non-repudiation)
- Understand Istio identity (users, services)
- Add end-user authentication using JWT
- Apply Mutual TLS (mTLS) for inter-service authentication
- Managing certificates
- mTLS Migration techniques
- Using namespaces and label selectors to enforce policies
- Define HTTP-based access-control
- Using JWT to define end-user/external client access control
Telemetry
- Overview of Istio's Observability options
- Using Envoy's access logs
- Introduce Metrics
- Understand the different levels of metrics gathering (Envoy, Service and control plane)
- Configuring service-level metrics
- Using Prometheus and Grafana for metric visualisation
- Trace request traffic through your mesh (Distributed traces)
- Using Jaeger as a trace-backend (discuss other options)
Frequently asked questions
What are the prerequisites?
Basic Kubernetes knowledge is expected; our Core Kubernetes Masterclass is the recommended preparation. Familiarity with microservice patterns helps but is not required.
Does the course cover Istio's ambient mode?
Yes. We cover the ambient data plane properly: the ztunnel node proxy, waypoint proxies for layer 7 policy, and how the two layers divide the work between them. Just as importantly, we cover when to choose ambient over sidecars and when not to, since most teams are running a sidecar mesh today and need a reason to move rather than an assumption.
How hands-on is the course?
Lab sessions run throughout the two days, covering installation, routing and HTTP rules, resilience and outlier detection, egress, mutual TLS, JWT authorisation, metrics and tracing, across both data planes.
Do I need to install anything on my laptop?
No. Every student gets their own pre-configured cloud machine with a running cluster, so all you need locally is an SSH client (already present on Linux, macOS and Windows). Work in the editors installed on the machine (vim, LazyVim, Emacs) or connect your own with VS Code Remote Development or IntelliJ's SSH remote development. Login details are emailed a week before the course.
How long is the Using Istio Service Mesh on k8s course?
2 days, on-site or online. Sessions can run on consecutive days or be spread out to fit your team's schedule.
How large are the groups?
Deliberately small so the trainer can adapt to every participant: at most 10 on-site and 7 online.
In which languages can the course be delivered?
English, French or Dutch.
