ICA cheat sheet

Istio version support: each minor release is supported for 6 months from release; upgrade path must be sequential (e.g., 1.17→1.18→1.19), skipping minors is unsupported.

istioctl install --set profile=demo installs a configuration that includes Istiod, ingress/egress gateways, and addons; production profiles (default, minimal) omit addons.

Configuration profiles: minimal installs only istiod; default installs istiod and ingress gateway; demo installs all components with lower resource requests; empty installs nothing (used for custom).

istioctl x precheck validates cluster compatibility (Kubernetes version, CRD conflicts) before install; istioctl analyze checks configuration for potential issues.

Revision-based upgrades: install new control plane with --revision canary; label namespaces istio.io/rev=canary to migrate workloads gradually; old revision remains until uninstalled.

istioctl upgrade performs in-place upgrade of control plane and gateways; requires same revision or no revision; does not upgrade data plane proxies automatically.

Sidecar injection: namespace label istio-injection=enabled or istio.io/rev=; pod label sidecar.istio.io/inject=false overrides; injection webhook configured by istiod.

IstioOperator configuration: istioctl install -f custom.yaml merges with default profile; components, meshConfig, values fields control installation; istioctl profile dump shows effective config.

Uninstall: istioctl uninstall --purge removes all Istio resources including CRDs; without --purge, CRDs and custom resources remain, allowing reinstall or revision cleanup.

VirtualService defines routing rules: hosts, gateways, http/tcp/tls routes with match conditions (URI, headers, method, source labels) and destinations with weights.

DestinationRule defines subsets (via labels) and traffic policies: load balancing (ROUND_ROBIN, LEAST_REQUEST, RANDOM, PASSTHROUGH), connection pool, outlier detection, TLS settings.

Gateway configures load balancer for ingress/egress: servers with port, hosts, TLS; binds to Envoy; VirtualService must reference gateway to apply.

Traffic splitting: in VirtualService http route, specify multiple destinations with weight (sum 100); used for canary releases; weights are relative, not percentages.

Fault injection: VirtualService http fault field with delay (fixedDelay, percentage) or abort (httpStatus, percentage); applied before routing; used for chaos testing.

Timeouts and retries: VirtualService http timeout (default 15s) and retries (attempts, perTryTimeout, retryOn); retries can cause cascading failures if not bounded.

ServiceEntry adds external services to mesh registry: hosts, addresses, ports, location (MESH_EXTERNAL/MESH_INTERNAL), resolution (DNS, STATIC, NONE); required for external access with REGISTRY_ONLY mode.

Sidecar resource limits scope of configuration: egress hosts, ingress listeners; reduces memory and config size for proxies; applied per namespace or workload selector.

Traffic mirroring: VirtualService http mirror field sends copy of traffic to another destination; mirrorPercentage controls fraction; original response returned to client.

PeerAuthentication sets mTLS mode: STRICT, PERMISSIVE, DISABLE; mesh-wide (root namespace) or namespace/workload-specific; STRICT rejects plaintext, PERMISSIVE accepts both.

AuthorizationPolicy defines allow/deny/audit rules: action ALLOW, DENY, AUDIT, CUSTOM; rules match source (principals, namespaces, IP blocks), operation (methods, paths, ports), conditions; default deny if any policy applied to workload.

RequestAuthentication validates JWT: issuer, jwksUri, audiences; applied to workloads; invalid tokens rejected, but no token allowed unless AuthorizationPolicy requires authentication.

JWT claim-based authorization: AuthorizationPolicy with when conditions on request.auth.claims; requires RequestAuthentication; claims available as request.auth.claims[].

mTLS certificate provisioning: Istiod (Citadel) issues SPIFFE certificates to sidecars; identity encoded in URI SAN spiffe:///ns//sa/.

AuthorizationPolicy evaluation: deny policies evaluated first, then allow; if no allow policies, default allow; if allow policies exist, default deny; audit policies log but do not enforce.

Ingress TLS: Gateway with TLS mode SIMPLE (certificate), MUTUAL (client cert), PASSTHROUGH; credentialName references Kubernetes secret in istio-system (or gateway namespace).

Egress TLS origination: DestinationRule trafficPolicy tls mode ISTIO_MUTUAL or SIMPLE; for external services, use ServiceEntry with TLS and DestinationRule to originate TLS.

Security best practices: enable STRICT mTLS mesh-wide, use AuthorizationPolicy default-deny, validate JWT at ingress, restrict egress with ServiceEntry and Sidecar, regularly rotate certificates (istiod handles automatically).

istioctl analyze detects configuration issues (e.g., conflicting VirtualServices, missing gateways, deprecated fields); use --all-namespaces and --suppress to filter.

istioctl proxy-status shows sync status of Envoy proxies with Istiod: SYNCED, NOT SENT, STALE; indicates config push issues.

istioctl proxy-config (pc) cluster/listener/route/endpoint inspects Envoy config; use -o json for detailed view; helps diagnose routing and load balancing.

istioctl dashboard opens Grafana, Jaeger, Kiali, Prometheus; requires addons installed; port-forward to access.

Common sidecar issues: injection disabled (check namespace label, pod annotation), init container failure (iptables), resource limits causing OOM; check istio-proxy logs and istio-init logs.

503 errors: often due to no healthy upstream (check endpoints), mTLS mismatch (PeerAuthentication), or missing ServiceEntry for external hosts; use istioctl proxy-config endpoint to verify.

Envoy access logs: enable via meshConfig.accessLogFile=/dev/stdout; logs show response code, flags, upstream host; useful for diagnosing routing and failures.

istioctl x describe pod summarizes configuration applied to pod: services, virtualservices, destinationrules, and potential issues.

Control plane logs: istiod logs at debug level (--log_level=debug); check for push errors, certificate issues, webhook failures; kubectl logs -n istio-system deploy/istiod.