Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.
Add this skill
npx mdskills install sickn33/istio-traffic-managementComprehensive Istio traffic management with 7 production-ready templates and clear best practices
1---2name: istio-traffic-management3description: Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.4---56# Istio Traffic Management78Comprehensive guide to Istio traffic management for production service mesh deployments.910## Do not use this skill when1112- The task is unrelated to istio traffic management13- You need a different domain or tool outside this scope1415## Instructions1617- Clarify goals, constraints, and required inputs.18- Apply relevant best practices and validate outcomes.19- Provide actionable steps and verification.20- If detailed examples are required, open `resources/implementation-playbook.md`.2122## Use this skill when2324- Configuring service-to-service routing25- Implementing canary or blue-green deployments26- Setting up circuit breakers and retries27- Load balancing configuration28- Traffic mirroring for testing29- Fault injection for chaos engineering3031## Core Concepts3233### 1. Traffic Management Resources3435| Resource | Purpose | Scope |36|----------|---------|-------|37| **VirtualService** | Route traffic to destinations | Host-based |38| **DestinationRule** | Define policies after routing | Service-based |39| **Gateway** | Configure ingress/egress | Cluster edge |40| **ServiceEntry** | Add external services | Mesh-wide |4142### 2. Traffic Flow4344```45Client → Gateway → VirtualService → DestinationRule → Service46 (routing) (policies) (pods)47```4849## Templates5051### Template 1: Basic Routing5253```yaml54apiVersion: networking.istio.io/v1beta155kind: VirtualService56metadata:57 name: reviews-route58 namespace: bookinfo59spec:60 hosts:61 - reviews62 http:63 - match:64 - headers:65 end-user:66 exact: jason67 route:68 - destination:69 host: reviews70 subset: v271 - route:72 - destination:73 host: reviews74 subset: v175---76apiVersion: networking.istio.io/v1beta177kind: DestinationRule78metadata:79 name: reviews-destination80 namespace: bookinfo81spec:82 host: reviews83 subsets:84 - name: v185 labels:86 version: v187 - name: v288 labels:89 version: v290 - name: v391 labels:92 version: v393```9495### Template 2: Canary Deployment9697```yaml98apiVersion: networking.istio.io/v1beta199kind: VirtualService100metadata:101 name: my-service-canary102spec:103 hosts:104 - my-service105 http:106 - route:107 - destination:108 host: my-service109 subset: stable110 weight: 90111 - destination:112 host: my-service113 subset: canary114 weight: 10115---116apiVersion: networking.istio.io/v1beta1117kind: DestinationRule118metadata:119 name: my-service-dr120spec:121 host: my-service122 trafficPolicy:123 connectionPool:124 tcp:125 maxConnections: 100126 http:127 h2UpgradePolicy: UPGRADE128 http1MaxPendingRequests: 100129 http2MaxRequests: 1000130 subsets:131 - name: stable132 labels:133 version: stable134 - name: canary135 labels:136 version: canary137```138139### Template 3: Circuit Breaker140141```yaml142apiVersion: networking.istio.io/v1beta1143kind: DestinationRule144metadata:145 name: circuit-breaker146spec:147 host: my-service148 trafficPolicy:149 connectionPool:150 tcp:151 maxConnections: 100152 http:153 http1MaxPendingRequests: 100154 http2MaxRequests: 1000155 maxRequestsPerConnection: 10156 maxRetries: 3157 outlierDetection:158 consecutive5xxErrors: 5159 interval: 30s160 baseEjectionTime: 30s161 maxEjectionPercent: 50162 minHealthPercent: 30163```164165### Template 4: Retry and Timeout166167```yaml168apiVersion: networking.istio.io/v1beta1169kind: VirtualService170metadata:171 name: ratings-retry172spec:173 hosts:174 - ratings175 http:176 - route:177 - destination:178 host: ratings179 timeout: 10s180 retries:181 attempts: 3182 perTryTimeout: 3s183 retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503184 retryRemoteLocalities: true185```186187### Template 5: Traffic Mirroring188189```yaml190apiVersion: networking.istio.io/v1beta1191kind: VirtualService192metadata:193 name: mirror-traffic194spec:195 hosts:196 - my-service197 http:198 - route:199 - destination:200 host: my-service201 subset: v1202 mirror:203 host: my-service204 subset: v2205 mirrorPercentage:206 value: 100.0207```208209### Template 6: Fault Injection210211```yaml212apiVersion: networking.istio.io/v1beta1213kind: VirtualService214metadata:215 name: fault-injection216spec:217 hosts:218 - ratings219 http:220 - fault:221 delay:222 percentage:223 value: 10224 fixedDelay: 5s225 abort:226 percentage:227 value: 5228 httpStatus: 503229 route:230 - destination:231 host: ratings232```233234### Template 7: Ingress Gateway235236```yaml237apiVersion: networking.istio.io/v1beta1238kind: Gateway239metadata:240 name: my-gateway241spec:242 selector:243 istio: ingressgateway244 servers:245 - port:246 number: 443247 name: https248 protocol: HTTPS249 tls:250 mode: SIMPLE251 credentialName: my-tls-secret252 hosts:253 - "*.example.com"254---255apiVersion: networking.istio.io/v1beta1256kind: VirtualService257metadata:258 name: my-vs259spec:260 hosts:261 - "api.example.com"262 gateways:263 - my-gateway264 http:265 - match:266 - uri:267 prefix: /api/v1268 route:269 - destination:270 host: api-service271 port:272 number: 8080273```274275## Load Balancing Strategies276277```yaml278apiVersion: networking.istio.io/v1beta1279kind: DestinationRule280metadata:281 name: load-balancing282spec:283 host: my-service284 trafficPolicy:285 loadBalancer:286 simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH287---288# Consistent hashing for sticky sessions289apiVersion: networking.istio.io/v1beta1290kind: DestinationRule291metadata:292 name: sticky-sessions293spec:294 host: my-service295 trafficPolicy:296 loadBalancer:297 consistentHash:298 httpHeaderName: x-user-id299 # or: httpCookie, useSourceIp, httpQueryParameterName300```301302## Best Practices303304### Do's305- **Start simple** - Add complexity incrementally306- **Use subsets** - Version your services clearly307- **Set timeouts** - Always configure reasonable timeouts308- **Enable retries** - But with backoff and limits309- **Monitor** - Use Kiali and Jaeger for visibility310311### Don'ts312- **Don't over-retry** - Can cause cascading failures313- **Don't ignore outlier detection** - Enable circuit breakers314- **Don't mirror to production** - Mirror to test environments315- **Don't skip canary** - Test with small traffic percentage first316317## Debugging Commands318319```bash320# Check VirtualService configuration321istioctl analyze322323# View effective routes324istioctl proxy-config routes deploy/my-app -o json325326# Check endpoint discovery327istioctl proxy-config endpoints deploy/my-app328329# Debug traffic330istioctl proxy-config log deploy/my-app --level debug331```332333## Resources334335- [Istio Traffic Management](https://istio.io/latest/docs/concepts/traffic-management/)336- [Virtual Service Reference](https://istio.io/latest/docs/reference/config/networking/virtual-service/)337- [Destination Rule Reference](https://istio.io/latest/docs/reference/config/networking/destination-rule/)338
Full transparency — inspect the skill content before installing.