Что такое Istio

• istiod: control plane (Pilot + Citadel + Galley merged)
• Envoy sidecar: data plane, injected automatically в labeled namespaces
• VirtualService: routing rules (weight, headers, retries)
• DestinationRule: subsets, load balancing policy
• AuthorizationPolicy: L7 access control

# Inject Istio в namespace
kubectl label namespace my-app istio-injection=enabled

# Canary deployment с VirtualService
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-app
spec:
  http:
  - route:
    - destination: { host: my-app, subset: v1 }
      weight: 80
    - destination: { host: my-app, subset: v2 }
      weight: 20
EOF

• Service Mesh
• Envoy
• mTLS