Istio Traffic Management

作者 wshobson46891e7e60da无许可证收录于 2026年10月8日更新于 2026年10月8日

Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.

仅含说明DevOps & Cloud

AI 生成的概览

配置 Istio 流量管理的指南：路由、负载均衡、熔断和灰度发布。

功能: 该技能提供服务网格中 Istio 流量管理的参考指导和 YAML 模板。内容涵盖 VirtualService、DestinationRule、Gateway 和 ServiceEntry 资源，并给出基础路由、灰度发布、熔断、重试与超时、流量镜像、故障注入和入口网关的模板。此外还列出负载均衡策略、最佳实践以及 istioctl 调试命令。
适用场景: 适用于配置服务间路由、灰度或蓝绿等渐进式发布、熔断与重试等韧性模式，以及流量镜像和故障注入。面向生产环境服务网格的流量策略工作。
运行要求: 不包含脚本，仅为说明和 YAML 模板。应用这些配置需要 Istio 服务网格以及对集群的 kubectl 或 istioctl 访问权限。

Istio Traffic Management

Comprehensive guide to Istio traffic management for production service mesh deployments.

When to Use This Skill

Configuring service-to-service routing
Implementing canary or blue-green deployments
Setting up circuit breakers and retries
Load balancing configuration
Traffic mirroring for testing
Fault injection for chaos engineering

Core Concepts

1. Traffic Management Resources

Resource	Purpose	Scope
VirtualService	Route traffic to destinations	Host-based
DestinationRule	Define policies after routing	Service-based
Gateway	Configure ingress/egress	Cluster edge
ServiceEntry	Add external services	Mesh-wide

2. Traffic Flow

Client → Gateway → VirtualService → DestinationRule → Service                   (routing)        (policies)        (pods)

Client → Gateway → VirtualService → DestinationRule → Service                   (routing)        (policies)        (pods)

Templates

Template 1: Basic Routing

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: reviews-route  namespace: bookinfospec:  hosts:    - reviews  http:    - match:        - headers:            end-user:              exact: jason      route:        - destination:            host: reviews            subset: v2    - route:        - destination:            host: reviews            subset: v1---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: reviews-destination  namespace: bookinfospec:  host: reviews  subsets:    - name: v1      labels:        version: v1    - name: v2      labels:        version: v2    - name: v3      labels:        version: v3

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: reviews-route  namespace: bookinfospec:  hosts:    - reviews  http:    - match:        - headers:            end-user:              exact: jason      route:        - destination:            host: reviews            subset: v2    - route:        - destination:            host: reviews            subset: v1---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: reviews-destination  namespace: bookinfospec:  host: reviews  subsets:    - name: v1      labels:        version: v1    - name: v2      labels:        version: v2    - name: v3      labels:        version: v3

Template 2: Canary Deployment

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-service-canaryspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: stable          weight: 90        - destination:            host: my-service            subset: canary          weight: 10---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: my-service-drspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        h2UpgradePolicy: UPGRADE        http1MaxPendingRequests: 100        http2MaxRequests: 1000  subsets:    - name: stable      labels:        version: stable    - name: canary      labels:        version: canary

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-service-canaryspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: stable          weight: 90        - destination:            host: my-service            subset: canary          weight: 10---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: my-service-drspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        h2UpgradePolicy: UPGRADE        http1MaxPendingRequests: 100        http2MaxRequests: 1000  subsets:    - name: stable      labels:        version: stable    - name: canary      labels:        version: canary

Template 3: Circuit Breaker

yaml

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: circuit-breakerspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        http1MaxPendingRequests: 100        http2MaxRequests: 1000        maxRequestsPerConnection: 10        maxRetries: 3    outlierDetection:      consecutive5xxErrors: 5      interval: 30s      baseEjectionTime: 30s      maxEjectionPercent: 50      minHealthPercent: 30

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: circuit-breakerspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        http1MaxPendingRequests: 100        http2MaxRequests: 1000        maxRequestsPerConnection: 10        maxRetries: 3    outlierDetection:      consecutive5xxErrors: 5      interval: 30s      baseEjectionTime: 30s      maxEjectionPercent: 50      minHealthPercent: 30

Template 4: Retry and Timeout

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: ratings-retryspec:  hosts:    - ratings  http:    - route:        - destination:            host: ratings      timeout: 10s      retries:        attempts: 3        perTryTimeout: 3s        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503        retryRemoteLocalities: true

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: ratings-retryspec:  hosts:    - ratings  http:    - route:        - destination:            host: ratings      timeout: 10s      retries:        attempts: 3        perTryTimeout: 3s        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503        retryRemoteLocalities: true

Template 5: Traffic Mirroring

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: mirror-trafficspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: v1      mirror:        host: my-service        subset: v2      mirrorPercentage:        value: 100.0

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: mirror-trafficspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: v1      mirror:        host: my-service        subset: v2      mirrorPercentage:        value: 100.0

Template 6: Fault Injection

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: fault-injectionspec:  hosts:    - ratings  http:    - fault:        delay:          percentage:            value: 10          fixedDelay: 5s        abort:          percentage:            value: 5          httpStatus: 503      route:        - destination:            host: ratings

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: fault-injectionspec:  hosts:    - ratings  http:    - fault:        delay:          percentage:            value: 10          fixedDelay: 5s        abort:          percentage:            value: 5          httpStatus: 503      route:        - destination:            host: ratings

Template 7: Ingress Gateway

yaml

apiVersion: networking.istio.io/v1beta1kind: Gatewaymetadata:  name: my-gatewayspec:  selector:    istio: ingressgateway  servers:    - port:        number: 443        name: https        protocol: HTTPS      tls:        mode: SIMPLE        credentialName: my-tls-secret      hosts:        - "*.example.com"---apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-vsspec:  hosts:    - "api.example.com"  gateways:    - my-gateway  http:    - match:        - uri:            prefix: /api/v1      route:        - destination:            host: api-service            port:              number: 8080

apiVersion: networking.istio.io/v1beta1kind: Gatewaymetadata:  name: my-gatewayspec:  selector:    istio: ingressgateway  servers:    - port:        number: 443        name: https        protocol: HTTPS      tls:        mode: SIMPLE        credentialName: my-tls-secret      hosts:        - "*.example.com"---apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-vsspec:  hosts:    - "api.example.com"  gateways:    - my-gateway  http:    - match:        - uri:            prefix: /api/v1      route:        - destination:            host: api-service            port:              number: 8080

Load Balancing Strategies

yaml

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: load-balancingspec:  host: my-service  trafficPolicy:    loadBalancer:      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH---# Consistent hashing for sticky sessionsapiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: sticky-sessionsspec:  host: my-service  trafficPolicy:    loadBalancer:      consistentHash:        httpHeaderName: x-user-id        # or: httpCookie, useSourceIp, httpQueryParameterName

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: load-balancingspec:  host: my-service  trafficPolicy:    loadBalancer:      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH---# Consistent hashing for sticky sessionsapiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: sticky-sessionsspec:  host: my-service  trafficPolicy:    loadBalancer:      consistentHash:        httpHeaderName: x-user-id        # or: httpCookie, useSourceIp, httpQueryParameterName

Best Practices

Do's

Start simple - Add complexity incrementally
Use subsets - Version your services clearly
Set timeouts - Always configure reasonable timeouts
Enable retries - But with backoff and limits
Monitor - Use Kiali and Jaeger for visibility

Don'ts

Don't over-retry - Can cause cascading failures
Don't ignore outlier detection - Enable circuit breakers
Don't mirror to production - Mirror to test environments
Don't skip canary - Test with small traffic percentage first

Debugging Commands

bash

# Check VirtualService configurationistioctl analyze
# View effective routesistioctl proxy-config routes deploy/my-app -o json
# Check endpoint discoveryistioctl proxy-config endpoints deploy/my-app
# Debug trafficistioctl proxy-config log deploy/my-app --level debug

# Check VirtualService configurationistioctl analyze
# View effective routesistioctl proxy-config routes deploy/my-app -o json
# Check endpoint discoveryistioctl proxy-config endpoints deploy/my-app
# Debug trafficistioctl proxy-config log deploy/my-app --level debug

来源与署名

来源：wshobson/agents位于plugins/cloud-infrastructure/skills/istio-traffic-management提交46891e7

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Istio Traffic Management

Istio Traffic Management

When to Use This Skill

Core Concepts

1. Traffic Management Resources

2. Traffic Flow

Templates

Template 1: Basic Routing

Template 2: Canary Deployment

Template 3: Circuit Breaker

Template 4: Retry and Timeout

Template 5: Traffic Mirroring

Template 6: Fault Injection

Template 7: Ingress Gateway

Load Balancing Strategies

Best Practices

Do's

Don'ts

Debugging Commands

来源与署名

更多来自 wshobson/agents 的技能

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

更多DevOps & Cloud技能

M5 Onboard

Runbook

Incident Response

Deploy Checklist

Spanner Basics

Secops Cases