README

Istio

Go Report Card GoDoc

Istio logo

An open platform to connect, manage, and secure microservices.

  • For in-depth information about how to use Istio, visit istio.io
  • To ask questions and get assistance from our community, visit discuss.istio.io
  • To learn how to participate in our overall community, visit our community page

In this README:

In addition, here are some other documents you may wish to read:

You'll find many other useful documents on our Wiki.

Introduction

Istio is an open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio's control plane provides an abstraction layer over the underlying cluster management platform, such as Kubernetes.

Istio is composed of these components:

  • Envoy - Sidecar proxies per microservice to handle ingress/egress traffic between services in the cluster and from a service to external services. The proxies form a secure microservice mesh providing a rich set of functions like discovery, rich layer-7 routing, circuit breakers, policy enforcement and telemetry recording/reporting functions.

    Note: The service mesh is not an overlay network. It simplifies and enhances how microservices in an application talk to each other over the network provided by the underlying platform.

  • Istiod - The Istio control plane. It provides service discovery, configuration and certificate management. It consists of the following sub-components:

    • Pilot - Responsible for configuring the proxies at runtime.

    • Citadel - Responsible for certificate issuance and rotation.

    • Galley - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.

  • Operator - The component provides user friendly options to operate the Istio service mesh.

Repositories

The Istio project is divided across a few GitHub repositories:

  • istio/api. This repository defines component-level APIs and common configuration formats for the Istio platform.

  • istio/community. This repository contains information on the Istio community, including the various documents that govern the Istio open source project.

  • istio/istio. This is the main code repository. It hosts Istio's core components, install artifacts, and sample programs. It includes:

    • istioctl. This directory contains code for the istioctl command line utility.

    • operator. This directory contains code for the Istio Operator.

    • pilot. This directory contains platform-specific code to populate the abstract service model, dynamically reconfigure the proxies when the application topology changes, as well as translate routing rules into proxy specific configuration.

    • security. This directory contains security related code, including Citadel (acting as Certificate Authority), citadel agent, etc.

  • istio/proxy. The Istio proxy contains extensions to the Envoy proxy (in the form of Envoy filters) that support authentication, authorization, and telemetry collection.

Issue management

We use GitHub to track all of our bugs and feature requests. Each issue we track has a variety of metadata:

  • Epic. An epic represents a feature area for Istio as a whole. Epics are fairly broad in scope and are basically product-level things. Each issue is ultimately part of an epic.

  • Milestone. Each issue is assigned a milestone. This is 0.1, 0.2, ..., or 'Nebulous Future'. The milestone indicates when we think the issue should get addressed.

  • Priority. Each issue has a priority which is represented by the column in the Prioritization project. Priority can be one of P0, P1, P2, or >P2. The priority indicates how important it is to address the issue within the milestone. P0 says that the milestone cannot be considered achieved if the issue isn't resolved.

Expand ▾ Collapse ▴

Directories

Path Synopsis
cni
cmd/istio-cni
This is a sample chained plugin that supports multiple CNI versions.
This is a sample chained plugin that supports multiple CNI versions.
cmd/istio-cni-repair
A simple daemonset binary to repair pods that are crashlooping after winning a race condition against istio-cni
A simple daemonset binary to repair pods that are crashlooping after winning a race condition against istio-cni
galley
pkg/config/processor/transforms
Package transforms contains basic processing building blocks that can be incorporated into bigger/self-contained processing pipelines.
Package transforms contains basic processing building blocks that can be incorporated into bigger/self-contained processing pipelines.
pkg/config/testing/basicmeta
Code generated for package basicmeta by go-bindata DO NOT EDIT.
Code generated for package basicmeta by go-bindata DO NOT EDIT.
pkg/config/testing/data
Code generated for package data by go-bindata DO NOT EDIT.
Code generated for package data by go-bindata DO NOT EDIT.
pkg/config/testing/k8smeta
Code generated for package k8smeta by go-bindata DO NOT EDIT.
Code generated for package k8smeta by go-bindata DO NOT EDIT.
testdatasets/validation
Code generated for package validation by go-bindata DO NOT EDIT.
Code generated for package validation by go-bindata DO NOT EDIT.
istioctl
cmd
cmd/istioctl
Command istioctl is a Istio configuration command line utility.
Command istioctl is a Istio configuration command line utility.
pkg/authz
The auth package provides support for checking the authentication and authorization policy applied in the mesh.
The auth package provides support for checking the authentication and authorization policy applied in the mesh.
pkg/clioptions
Package clioptions contains flags which can be added to istiocl commands.
Package clioptions contains flags which can be added to istiocl commands.
operator
cmd
cmd/mesh
Package mesh contains types and functions.
Package mesh contains types and functions.
pkg/apis/istio/v1alpha1
Package v1alpha1 contains API Schema definitions for the istio v1alpha1 API group Package v1alpha1 contains API Schema definitions for the istio v1alpha1 API group +k8s:deepcopy-gen=package,register +groupName=install.istio.io
Package v1alpha1 contains API Schema definitions for the istio v1alpha1 API group Package v1alpha1 contains API Schema definitions for the istio v1alpha1 API group +k8s:deepcopy-gen=package,register +groupName=install.istio.io
pkg/component
Package component defines an in-memory representation of IstioOperator.<Feature>.<Component>.
Package component defines an in-memory representation of IstioOperator.<Feature>.<Component>.
pkg/metrics
Package metrics defines metrics and monitoring functionality used throughout operator.
Package metrics defines metrics and monitoring functionality used throughout operator.
pkg/object
Package manifest provides functions for going between in-memory k8s objects (unstructured.Unstructured) and their JSON or YAML representations.
Package manifest provides functions for going between in-memory k8s objects (unstructured.Unstructured) and their JSON or YAML representations.
pkg/patch
Package patch implements a simple patching mechanism for k8s resources.
Package patch implements a simple patching mechanism for k8s resources.
pkg/tpath
struct.go contains functions for traversing and modifying trees of Go structs.
struct.go contains functions for traversing and modifying trees of Go structs.
pkg/translate
Package translate defines translations from installer proto to values.yaml.
Package translate defines translations from installer proto to values.yaml.
pilot
pkg/config/aggregate
Package aggregate implements a read-only aggregator for config stores.
Package aggregate implements a read-only aggregator for config stores.
pkg/config/kube/crdclient
Package crdclient provides an implementation of the config store and cache using Kubernetes Custom Resources and the informer framework from Kubernetes This code relies heavily on code generation for performance reasons; to implement the Istio store interface, we need to take dynamic inputs.
Package crdclient provides an implementation of the config store and cache using Kubernetes Custom Resources and the informer framework from Kubernetes This code relies heavily on code generation for performance reasons; to implement the Istio store interface, we need to take dynamic inputs.
pkg/config/kube/crdclient/gen
Tool to generate pilot/pkg/config/kube/crdclient/types.gen.go Example run command: REPO_ROOT=`pwd` go generate ./pilot/pkg/config/kube/crdclient/...
Tool to generate pilot/pkg/config/kube/crdclient/types.gen.go Example run command: REPO_ROOT=`pwd` go generate ./pilot/pkg/config/kube/crdclient/...
pkg/config/kube/ingress
Package ingress provides a read-only view of Kubernetes ingress resources as an ingress rule configuration type store
Package ingress provides a read-only view of Kubernetes ingress resources as an ingress rule configuration type store
pkg/config/kube/ingressv1
Package ingress provides a read-only view of Kubernetes ingress resources as an ingress rule configuration type store
Package ingress provides a read-only view of Kubernetes ingress resources as an ingress rule configuration type store
pkg/config/memory
Package memory provides an in-memory volatile config store implementation
Package memory provides an in-memory volatile config store implementation
pkg/networking/core/v1alpha3/loadbalancer
packages used for load balancer setting
packages used for load balancer setting
pkg/networking/plugin/registry
Package registry represents a registry of plugins that can be used by a config generator.
Package registry represents a registry of plugins that can be used by a config generator.
pkg
cmd
config
Package config is a common, top-level folder for aggregating Istio-wide config related libraries and utilities.
Package config is a common, top-level folder for aggregating Istio-wide config related libraries and utilities.
config/resource
Package resource contains core abstract types for representing configuration resources.
Package resource contains core abstract types for representing configuration resources.
config/schema
Code generated for package schema by go-bindata DO NOT EDIT.
Code generated for package schema by go-bindata DO NOT EDIT.
config/xds
nolint: lll
nolint: lll
jwt
kube/apimirror
apimirror contains copies of Kubernetes APIs.
apimirror contains copies of Kubernetes APIs.
kube/inject
Package inject implements kube-inject or webhoook autoinject feature to inject sidecar.
Package inject implements kube-inject or webhoook autoinject feature to inject sidecar.
mcp/status
Package status implements errors returned by gRPC.
Package status implements errors returned by gRPC.
test/config
Package test is a generated protocol buffer package.
Package test is a generated protocol buffer package.
test/framework/components/gcemetadata
Package gcemetadata provides basic utilities around configuring the fake GCE Metadata Server component for integration testing.
Package gcemetadata provides basic utilities around configuring the fake GCE Metadata Server component for integration testing.
uds
url
webhooks/validation/controller
Package controller implements a k8s controller for managing the lifecycle of a validating webhook.
Package controller implements a k8s controller for managing the lifecycle of a validating webhook.
samples
extauthz/src Module
security
pkg/credentialfetcher
credentailfetcher fetches workload credentials through platform plugins.
credentailfetcher fetches workload credentials through platform plugins.
pkg/credentialfetcher/plugin
This is Google plugin of credentialfetcher.
This is Google plugin of credentialfetcher.
pkg/nodeagent/cache
Package cache is the in-memory secret store.
Package cache is the in-memory secret store.
pkg/nodeagent/plugin/providers/google/stsclient
Package stsclient is for oauth token exchange integration.
Package stsclient is for oauth token exchange integration.
pkg/nodeagent/sds
Package sds implements secret discovery service in NodeAgent.
Package sds implements secret discovery service in NodeAgent.
pkg/testing/sdsc
Package sdsc includes a lightweight testing client to interact with SDS.
Package sdsc includes a lightweight testing client to interact with SDS.
tools/sdsclient
Program sdsclient simulates a SDS client to test SDS Server, citadel agent.
Program sdsclient simulates a SDS client to test SDS Server, citadel agent.
tests
common/jwt
package jwt includes sample JWT Token used in e2e tests.
package jwt includes sample JWT Token used in e2e tests.
fuzz
nolint: golint // Avoid it complaining about the Fuzz function name; it is required
nolint: golint // Avoid it complaining about the Fuzz function name; it is required
util/leak
leak checks for goroutine leaks in tests This is (heavily) inspired by https://github.com/grpc/grpc-go/blob/master/internal/leakcheck/leakcheck.go and https://github.com/fortytw2/leaktest
leak checks for goroutine leaks in tests This is (heavily) inspired by https://github.com/grpc/grpc-go/blob/master/internal/leakcheck/leakcheck.go and https://github.com/fortytw2/leaktest
tools
bug-report/pkg/common
Package common contains resource names, which may vary from version to version.
Package common contains resource names, which may vary from version to version.