Istio Traffic Management

作者 wshobson46891e7e60da無授權條款收錄於 2026年10月8日更新於 2026年10月8日

Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.

僅含說明DevOps & Cloud

AI 產生的概覽

設定 Istio 流量管理的指南：路由、負載平衡、斷路器與漸進式部署。

功能: 此技能提供服務網格中 Istio 流量管理的參考指引與 YAML 範本。內容涵蓋 VirtualService、DestinationRule、Gateway 與 ServiceEntry 資源，並提供基本路由、金絲雀部署、斷路器、重試與逾時、流量鏡像、故障注入及入口閘道的範本。此外也列出負載平衡策略、最佳實務以及 istioctl 除錯指令。
適用情境: 適用於設定服務對服務路由、金絲雀或藍綠等漸進式部署、斷路器與重試等韌性模式，以及流量鏡像與故障注入。鎖定正式環境服務網格的流量政策工作。
執行需求: 不含指令碼，僅為說明與 YAML 範本。套用這些設定需要 Istio 服務網格，以及對叢集的 kubectl 或 istioctl 存取權限。

Istio Traffic Management

Comprehensive guide to Istio traffic management for production service mesh deployments.

When to Use This Skill

Configuring service-to-service routing
Implementing canary or blue-green deployments
Setting up circuit breakers and retries
Load balancing configuration
Traffic mirroring for testing
Fault injection for chaos engineering

Core Concepts

1. Traffic Management Resources

Resource	Purpose	Scope
VirtualService	Route traffic to destinations	Host-based
DestinationRule	Define policies after routing	Service-based
Gateway	Configure ingress/egress	Cluster edge
ServiceEntry	Add external services	Mesh-wide

2. Traffic Flow

Client → Gateway → VirtualService → DestinationRule → Service                   (routing)        (policies)        (pods)

Client → Gateway → VirtualService → DestinationRule → Service                   (routing)        (policies)        (pods)

Templates

Template 1: Basic Routing

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: reviews-route  namespace: bookinfospec:  hosts:    - reviews  http:    - match:        - headers:            end-user:              exact: jason      route:        - destination:            host: reviews            subset: v2    - route:        - destination:            host: reviews            subset: v1---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: reviews-destination  namespace: bookinfospec:  host: reviews  subsets:    - name: v1      labels:        version: v1    - name: v2      labels:        version: v2    - name: v3      labels:        version: v3

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: reviews-route  namespace: bookinfospec:  hosts:    - reviews  http:    - match:        - headers:            end-user:              exact: jason      route:        - destination:            host: reviews            subset: v2    - route:        - destination:            host: reviews            subset: v1---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: reviews-destination  namespace: bookinfospec:  host: reviews  subsets:    - name: v1      labels:        version: v1    - name: v2      labels:        version: v2    - name: v3      labels:        version: v3

Template 2: Canary Deployment

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-service-canaryspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: stable          weight: 90        - destination:            host: my-service            subset: canary          weight: 10---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: my-service-drspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        h2UpgradePolicy: UPGRADE        http1MaxPendingRequests: 100        http2MaxRequests: 1000  subsets:    - name: stable      labels:        version: stable    - name: canary      labels:        version: canary

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-service-canaryspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: stable          weight: 90        - destination:            host: my-service            subset: canary          weight: 10---apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: my-service-drspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        h2UpgradePolicy: UPGRADE        http1MaxPendingRequests: 100        http2MaxRequests: 1000  subsets:    - name: stable      labels:        version: stable    - name: canary      labels:        version: canary

Template 3: Circuit Breaker

yaml

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: circuit-breakerspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        http1MaxPendingRequests: 100        http2MaxRequests: 1000        maxRequestsPerConnection: 10        maxRetries: 3    outlierDetection:      consecutive5xxErrors: 5      interval: 30s      baseEjectionTime: 30s      maxEjectionPercent: 50      minHealthPercent: 30

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: circuit-breakerspec:  host: my-service  trafficPolicy:    connectionPool:      tcp:        maxConnections: 100      http:        http1MaxPendingRequests: 100        http2MaxRequests: 1000        maxRequestsPerConnection: 10        maxRetries: 3    outlierDetection:      consecutive5xxErrors: 5      interval: 30s      baseEjectionTime: 30s      maxEjectionPercent: 50      minHealthPercent: 30

Template 4: Retry and Timeout

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: ratings-retryspec:  hosts:    - ratings  http:    - route:        - destination:            host: ratings      timeout: 10s      retries:        attempts: 3        perTryTimeout: 3s        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503        retryRemoteLocalities: true

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: ratings-retryspec:  hosts:    - ratings  http:    - route:        - destination:            host: ratings      timeout: 10s      retries:        attempts: 3        perTryTimeout: 3s        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503        retryRemoteLocalities: true

Template 5: Traffic Mirroring

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: mirror-trafficspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: v1      mirror:        host: my-service        subset: v2      mirrorPercentage:        value: 100.0

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: mirror-trafficspec:  hosts:    - my-service  http:    - route:        - destination:            host: my-service            subset: v1      mirror:        host: my-service        subset: v2      mirrorPercentage:        value: 100.0

Template 6: Fault Injection

yaml

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: fault-injectionspec:  hosts:    - ratings  http:    - fault:        delay:          percentage:            value: 10          fixedDelay: 5s        abort:          percentage:            value: 5          httpStatus: 503      route:        - destination:            host: ratings

apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: fault-injectionspec:  hosts:    - ratings  http:    - fault:        delay:          percentage:            value: 10          fixedDelay: 5s        abort:          percentage:            value: 5          httpStatus: 503      route:        - destination:            host: ratings

Template 7: Ingress Gateway

yaml

apiVersion: networking.istio.io/v1beta1kind: Gatewaymetadata:  name: my-gatewayspec:  selector:    istio: ingressgateway  servers:    - port:        number: 443        name: https        protocol: HTTPS      tls:        mode: SIMPLE        credentialName: my-tls-secret      hosts:        - "*.example.com"---apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-vsspec:  hosts:    - "api.example.com"  gateways:    - my-gateway  http:    - match:        - uri:            prefix: /api/v1      route:        - destination:            host: api-service            port:              number: 8080

apiVersion: networking.istio.io/v1beta1kind: Gatewaymetadata:  name: my-gatewayspec:  selector:    istio: ingressgateway  servers:    - port:        number: 443        name: https        protocol: HTTPS      tls:        mode: SIMPLE        credentialName: my-tls-secret      hosts:        - "*.example.com"---apiVersion: networking.istio.io/v1beta1kind: VirtualServicemetadata:  name: my-vsspec:  hosts:    - "api.example.com"  gateways:    - my-gateway  http:    - match:        - uri:            prefix: /api/v1      route:        - destination:            host: api-service            port:              number: 8080

Load Balancing Strategies

yaml

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: load-balancingspec:  host: my-service  trafficPolicy:    loadBalancer:      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH---# Consistent hashing for sticky sessionsapiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: sticky-sessionsspec:  host: my-service  trafficPolicy:    loadBalancer:      consistentHash:        httpHeaderName: x-user-id        # or: httpCookie, useSourceIp, httpQueryParameterName

apiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: load-balancingspec:  host: my-service  trafficPolicy:    loadBalancer:      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH---# Consistent hashing for sticky sessionsapiVersion: networking.istio.io/v1beta1kind: DestinationRulemetadata:  name: sticky-sessionsspec:  host: my-service  trafficPolicy:    loadBalancer:      consistentHash:        httpHeaderName: x-user-id        # or: httpCookie, useSourceIp, httpQueryParameterName

Best Practices

Do's

Start simple - Add complexity incrementally
Use subsets - Version your services clearly
Set timeouts - Always configure reasonable timeouts
Enable retries - But with backoff and limits
Monitor - Use Kiali and Jaeger for visibility

Don'ts

Don't over-retry - Can cause cascading failures
Don't ignore outlier detection - Enable circuit breakers
Don't mirror to production - Mirror to test environments
Don't skip canary - Test with small traffic percentage first

Debugging Commands

bash

# Check VirtualService configurationistioctl analyze
# View effective routesistioctl proxy-config routes deploy/my-app -o json
# Check endpoint discoveryistioctl proxy-config endpoints deploy/my-app
# Debug trafficistioctl proxy-config log deploy/my-app --level debug

# Check VirtualService configurationistioctl analyze
# View effective routesistioctl proxy-config routes deploy/my-app -o json
# Check endpoint discoveryistioctl proxy-config endpoints deploy/my-app
# Debug trafficistioctl proxy-config log deploy/my-app --level debug

來源與署名

來源：wshobson/agents位於plugins/cloud-infrastructure/skills/istio-traffic-management提交46891e7

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Istio Traffic Management

Istio Traffic Management

When to Use This Skill

Core Concepts

1. Traffic Management Resources

2. Traffic Flow

Templates

Template 1: Basic Routing

Template 2: Canary Deployment

Template 3: Circuit Breaker

Template 4: Retry and Timeout

Template 5: Traffic Mirroring

Template 6: Fault Injection

Template 7: Ingress Gateway

Load Balancing Strategies

Best Practices

Do's

Don'ts

Debugging Commands

來源與署名

更多來自 wshobson/agents 的技能

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

更多DevOps & Cloud技能

M5 Onboard

Runbook

Incident Response

Deploy Checklist

Spanner Basics

Secops Cases