loom-istio

# Istio Service Mesh ## Overview Istio is a service mesh: Envoy proxies intercept all service traffic to provide traffic management, mTLS, and observability with no app changes. **Two data-plane models — pick deliberately:** - **Sidecar** (classic): one Envoy per pod; full L7 everywhere; higher per-pod CPU/mem and injection restart cost. - **Ambient** (GA in 1.24): per-node **ztunnel** does L4 mTLS + L4 auth/telemetry automatically; **waypoint** proxies add L7 only where deployed. Lower overhead, no injection restarts, but L7 features silently no-op without a waypoint. See *Currency*. ### Quick Reference: Common Tasks | Task | Resources | Section | | ---------------------------- | ---------------------------------- | ------------------------------------- | | Enable mTLS between services | PeerAuthentication | mTLS PeerAuthentication | | Route traffic to new version | VirtualService + DestinationRule | Traffic Splitting for Canary | | Add circuit breaker | DestinationRule (outlierDetection) | Circuit Breaker and Retry | | Configure retries/timeouts | VirtualService (retries, timeout) | Circuit Breaker and Retry | | Expose service to internet | Gateway + VirtualService | Gateway and VirtualService | | Control egress traffic | Sidecar + ServiceEntry | Sidecar Resource for Egress ...