Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.
npx mdskills install sickn33/istio-traffic-management@sickn33? Sign in with GitHub to claim this listing.Comprehensive Istio traffic management with 7 production-ready templates and clear best practices
1---2name: istio-traffic-management3description: Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.4---56# Istio Traffic Management78Comprehensive guide to Istio traffic management for production service mesh deployments.910## Do not use this skill when1112- The task is unrelated to istio traffic management13- You need a different domain or tool outside this scope1415## Instructions1617- Clarify goals, constraints, and required inputs.18- Apply relevant best practices and validate outcomes.19- Provide actionable steps and verification.20- If detailed examples are required, open `resources/implementation-playbook.md`.2122## Use this skill when2324- Configuring service-to-service routing25- Implementing canary or blue-green deployments26- Setting up circuit breakers and retries27- Load balancing configuration28- Traffic mirroring for testing29- Fault injection for chaos engineering3031## Core Concepts3233### 1. Traffic Management Resources3435| Resource | Purpose | Scope |36|----------|---------|-------|37| **VirtualService** | Route traffic to destinations | Host-based |38| **DestinationRule** | Define policies after routing | Service-based |39| **Gateway** | Configure ingress/egress | Cluster edge |40| **ServiceEntry** | Add external services | Mesh-wide |4142### 2. Traffic Flow4344```45Client → Gateway → VirtualService → DestinationRule → Service46 (routing) (policies) (pods)47```4849## Templates5051### Template 1: Basic Routing5253```yaml54apiVersion: networking.istio.io/v1beta155kind: VirtualService56metadata:57 name: reviews-route58 namespace: bookinfo59spec:60 hosts:61 - reviews62 http:63 - match:64 - headers:65 end-user:66 exact: jason67 route:68 - destination:69 host: reviews70 subset: v271 - route:72 - destination:73 host: reviews74 subset: v175---76apiVersion: networking.istio.io/v1beta177kind: DestinationRule78metadata:79 name: reviews-destination80 namespace: bookinfo81spec:82 host: reviews83 subsets:84 - name: v185 labels:86 version: v187 - name: v288 labels:89 version: v290 - name: v391 labels:92 version: v393```9495### Template 2: Canary Deployment9697```yaml98apiVersion: networking.istio.io/v1beta199kind: VirtualService100metadata:101 name: my-service-canary102spec:103 hosts:104 - my-service105 http:106 - route:107 - destination:108 host: my-service109 subset: stable110 weight: 90111 - destination:112 host: my-service113 subset: canary114 weight: 10115---116apiVersion: networking.istio.io/v1beta1117kind: DestinationRule118metadata:119 name: my-service-dr120spec:121 host: my-service122 trafficPolicy:123 connectionPool:124 tcp:125 maxConnections: 100126 http:127 h2UpgradePolicy: UPGRADE128 http1MaxPendingRequests: 100129 http2MaxRequests: 1000130 subsets:131 - name: stable132 labels:133 version: stable134 - name: canary135 labels:136 version: canary137```138139### Template 3: Circuit Breaker140141```yaml142apiVersion: networking.istio.io/v1beta1143kind: DestinationRule144metadata:145 name: circuit-breaker146spec:147 host: my-service148 trafficPolicy:149 connectionPool:150 tcp:151 maxConnections: 100152 http:153 http1MaxPendingRequests: 100154 http2MaxRequests: 1000155 maxRequestsPerConnection: 10156 maxRetries: 3157 outlierDetection:158 consecutive5xxErrors: 5159 interval: 30s160 baseEjectionTime: 30s161 maxEjectionPercent: 50162 minHealthPercent: 30163```164165### Template 4: Retry and Timeout166167```yaml168apiVersion: networking.istio.io/v1beta1169kind: VirtualService170metadata:171 name: ratings-retry172spec:173 hosts:174 - ratings175 http:176 - route:177 - destination:178 host: ratings179 timeout: 10s180 retries:181 attempts: 3182 perTryTimeout: 3s183 retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503184 retryRemoteLocalities: true185```186187### Template 5: Traffic Mirroring188189```yaml190apiVersion: networking.istio.io/v1beta1191kind: VirtualService192metadata:193 name: mirror-traffic194spec:195 hosts:196 - my-service197 http:198 - route:199 - destination:200 host: my-service201 subset: v1202 mirror:203 host: my-service204 subset: v2205 mirrorPercentage:206 value: 100.0207```208209### Template 6: Fault Injection210211```yaml212apiVersion: networking.istio.io/v1beta1213kind: VirtualService214metadata:215 name: fault-injection216spec:217 hosts:218 - ratings219 http:220 - fault:221 delay:222 percentage:223 value: 10224 fixedDelay: 5s225 abort:226 percentage:227 value: 5228 httpStatus: 503229 route:230 - destination:231 host: ratings232```233234### Template 7: Ingress Gateway235236```yaml237apiVersion: networking.istio.io/v1beta1238kind: Gateway239metadata:240 name: my-gateway241spec:242 selector:243 istio: ingressgateway244 servers:245 - port:246 number: 443247 name: https248 protocol: HTTPS249 tls:250 mode: SIMPLE251 credentialName: my-tls-secret252 hosts:253 - "*.example.com"254---255apiVersion: networking.istio.io/v1beta1256kind: VirtualService257metadata:258 name: my-vs259spec:260 hosts:261 - "api.example.com"262 gateways:263 - my-gateway264 http:265 - match:266 - uri:267 prefix: /api/v1268 route:269 - destination:270 host: api-service271 port:272 number: 8080273```274275## Load Balancing Strategies276277```yaml278apiVersion: networking.istio.io/v1beta1279kind: DestinationRule280metadata:281 name: load-balancing282spec:283 host: my-service284 trafficPolicy:285 loadBalancer:286 simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH287---288# Consistent hashing for sticky sessions289apiVersion: networking.istio.io/v1beta1290kind: DestinationRule291metadata:292 name: sticky-sessions293spec:294 host: my-service295 trafficPolicy:296 loadBalancer:297 consistentHash:298 httpHeaderName: x-user-id299 # or: httpCookie, useSourceIp, httpQueryParameterName300```301302## Best Practices303304### Do's305- **Start simple** - Add complexity incrementally306- **Use subsets** - Version your services clearly307- **Set timeouts** - Always configure reasonable timeouts308- **Enable retries** - But with backoff and limits309- **Monitor** - Use Kiali and Jaeger for visibility310311### Don'ts312- **Don't over-retry** - Can cause cascading failures313- **Don't ignore outlier detection** - Enable circuit breakers314- **Don't mirror to production** - Mirror to test environments315- **Don't skip canary** - Test with small traffic percentage first316317## Debugging Commands318319```bash320# Check VirtualService configuration321istioctl analyze322323# View effective routes324istioctl proxy-config routes deploy/my-app -o json325326# Check endpoint discovery327istioctl proxy-config endpoints deploy/my-app328329# Debug traffic330istioctl proxy-config log deploy/my-app --level debug331```332333## Resources334335- [Istio Traffic Management](https://istio.io/latest/docs/concepts/traffic-management/)336- [Virtual Service Reference](https://istio.io/latest/docs/reference/config/networking/virtual-service/)337- [Destination Rule Reference](https://istio.io/latest/docs/reference/config/networking/destination-rule/)338
Full transparency — inspect the skill content before installing.