Day 21: Challenge — Istio mTLS and Traffic Shifting

Phase 3 · Jul 21, 2026

Challenge Overview

Configure Istio to enforce mTLS and perform a safe canary deployment.

Requirements:

1. Deploy echo-v1 and echo-v2 services to a local Istio mesh
2. Enforce STRICT mTLS in the deployment namespace
3. Create a VirtualService that routes 90% to v1, 10% to v2
4. Add a 5-second timeout and 2 retries to the VirtualService
5. Inject 5% 503 faults on v1 to simulate failures
6. Gradually shift traffic: 75/25, then 50/50, then 0/100 using kubectl patch
7. Observe service graph in Kiali during each shift

Deployment Config

# echo-v1 and echo-v2 deployments with version label
apiVersion: apps/v1
kind: Deployment
metadata: { name: echo-v1 }
spec:
  selector: { matchLabels: { app: echo, version: v1 } }
  template:
    metadata: { labels: { app: echo, version: v1 } }
    spec:
      containers:
      - name: echo
        image: ealen/echo-server:latest
        ports: [{ containerPort: 80 }]

Required Resources

PeerAuthentication:   STRICT mTLS for namespace
DestinationRule:      Define v1 and v2 subsets + outlier detection
VirtualService:       90/10 split + timeout + retry + fault injection
AuthorizationPolicy:  Allow traffic only between labeled services

Traffic Shift Commands

# Shift to 75/25
kubectl patch virtualservice echo --type=merge -p '
{"spec":{"http":[{"route":[
  {"destination":{"host":"echo","subset":"v1"},"weight":75},
  {"destination":{"host":"echo","subset":"v2"},"weight":25}
]}]}}'

# Shift to 50/50
kubectl patch virtualservice echo --type=merge -p '...'

# Full cutover to v2
kubectl patch virtualservice echo --type=merge -p '
{"spec":{"http":[{"route":[
  {"destination":{"host":"echo","subset":"v2"},"weight":100}
]}]}}'

Phase 3 Complete

You can now:

• Design, implement, and version binary protocols
• Build gRPC services with streaming, auth, and deadline propagation
• Deploy services into an Istio mesh with automatic mTLS and traffic shaping

Phase 4 starts tomorrow: Reliability Patterns — circuit breakers, distributed transactions, event sourcing.