# istio Published articles for istio. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Why GitHub feels less reliable lately DevFeed: [Why GitHub feels less reliable lately]() Original publisher: [Read original article]() Author: Sridhar Rajarao Published: 2026-08-23T00:00:00Z Content type: opinion Language: en Sources: [Sridhar Rajarao]() Topics: [GitHub](), [incident](), [migration](), [systems](), [Azure](), [GitHub Actions](), [pull-requests]() Tags: [autoscaling](), [capacity](), [concurrency](), [data-centers](), [deployment](), [github](), [incident](), [incident-management](), [istio](), [reliability](), [request](), [resilience](), [sre](), [transformation]() ### AI overview The article argues that GitHub's recent reliability problems reflect the difficult middle of a major infrastructure transformation. It connects incidents to migration complexity, unsafe automation, configuration mistakes, capacity and concurrency weaknesses, database migration errors, and autoscaling problems. ### Source excerpt GitHub is not having one outage problem. Its recent incident reports show the difficult middle of a platform transformation. ## 【Istio 控制面】选型收束与开放问题：CRD、Gateway API 与 eBPF L4 的排除树 DevFeed: [【Istio 控制面】选型收束与开放问题：CRD、Gateway API 与 eBPF L4 的排除树]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-11T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [istio](), [gateway](), [eBPF]() Tags: [ambient](), [cilium](), [ebpf](), [experimental](), [gamma](), [gateway](), [gateway-api](), [istio](), [kubernetes](), [mesh](), [network](), [open-problems](), [selection](), [xds]() ### AI overview The concluding article in an Istio control-plane series presents a mechanism-based decision tree for choosing among Istio CRDs, Gateway API/GAMMA, and eBPF L4 networking. It explains that Istio CRDs and Gateway API are alternative configuration inputs compiled by istiod into xDS resources, while eBPF L4 avoids xDS entirely. It also identifies open questions around configuration-activation SLOs, Ambient maturity, and coexistence between configuration models. ### Source excerpt 用机制排除树收束 Istio CRD 翻译、Gateway API/GAMMA 与 eBPF L4 的选型边界，回收系列阅读路径，并列出推送 SLO、Ambient 成熟度、GAMMA 双轨等开放问题；不做延迟排行榜。 ## 【Istio 控制面】控制面全景：从 CRD 到 xDS 的翻译与推送内核 DevFeed: [【Istio 控制面】控制面全景：从 CRD 到 xDS 的翻译与推送内核]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-11T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [istio](), [Architecture & Design]() Tags: [ambient](), [control-plane](), [gateway-api](), [istio](), [istiod](), [k8s](), [kubernetes](), [network](), [pilot](), [service-mesh](), [sidecar](), [xds]() ### AI overview This first article in a 16-part series maps the Istio control plane's role between configuration inputs and proxy-side xDS consumption. It defines five analytical axes and uses Istio 1.30.3 as its version anchor, while outlining the series' scope and boundaries. ### Source excerpt 定位 Istio 控制面内核相对 Envoy 消费侧、Service Mesh 税文与 Gateway API 资源模型的缺口；给出五条坐标系、16 篇地图与本系列明确不写的范围，钉住 istiod 1.30.3 为主线。 ## 【Istio 控制面】Linkerd 对照：非 xDS 的控制面机制 DevFeed: [【Istio 控制面】Linkerd 对照：非 xDS 的控制面机制]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-11T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [istio](), [linkerd](), [API](), [proxy]() Tags: [api](), [control-plane](), [destination-controller](), [envoy](), [go](), [identity](), [istio](), [istiod](), [kubernetes](), [linkerd](), [mechanism-comparison](), [network](), [policy](), [proxy](), [route](), [rust](), [service](), [serviceaccount](), [sidecar](), [xds]() ### AI overview This article compares Linkerd's control-plane architecture with Istio's istiod and xDS model. It describes Linkerd's separately deployed destination, identity, and proxy-injector components; its proxy-specific gRPC APIs; and its CSR-based identity issuance, contrasting these with Istio's consolidated control plane and xDS/SDS resource model. It explicitly avoids declaring either system superior without workload-specific evidence. ### Source excerpt 以官方文档为准，对照 Linkerd destination/identity 控制面与 Istio istiod/xDS 的机制差异：资源模型、订阅形状、身份签发路径；只讲机制边界，不判定优劣。 ## Nine years of predicting cloud native, scored honestly " Giant Swarm DevFeed: [Nine years of predicting cloud native, scored honestly " Giant Swarm]() Original publisher: [Read original article]() Author: Oliver Thylmann Published: 2026-06-29T10:07:32Z Content type: opinion Language: en Sources: [Giant Swarm Blog]() Topics: [Cloud Native Ecosystem](), [Platform Engineering](), [Kubernetes](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [cloud](), [cloud-native](), [grafana](), [history](), [istio](), [kubernetes](), [microservices](), [open-source](), [platform-engineering](), [tech]() ### AI overview An author reflects on nine years of publishing and scoring annual cloud-native predictions. The article argues that making predictions specific and publicly scoring misses can expose the gap between expectations and reality. It traces a shift from Kubernetes-related technologies to platform engineering and, later, AI in operations. ### Source excerpt I started writing annual predictions in 2017 to find out whether I could read the industry. Nine years in, that's turned out to be one of the least interesting things the exercise has done. What it does instead is harder to say, or harder to predict. Something like: it surfaces the gap between what I think will happen and what I want to be true. Nine years of scoring myself has been nine years of watching that gap. ## How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs DevFeed: [How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeffrey Ellin) Published: 2026-05-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SPIFFE](), [Zero Trust](), [certificates](), [istio](), [Kubernetes]() Tags: [api](), [certificates](), [istio](), [kubernetes](), [mesh](), [spiffe](), [zero-trust]() ### AI overview This tutorial explains how to extend SPIFFE-based zero-trust workload identity beyond Kubernetes to VMs, edge gateways, and legacy services. It describes separating identity issuance from consumption, using short-lived identities through a local API, with Envoy consuming identity via SDS and Teleport managing the trust chain. ### Source excerpt Discover how Envoy + SDS and Teleport Workload Identity let off-cluster workloads securely call Istio services without distributing certificates. ## Service Mesh Architecture: Sidecar Overhead, Istio, and Alternatives Without Sidecars DevFeed: [Service Mesh Architecture: Sidecar Overhead, Istio, and Alternatives Without Sidecars]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-04-13T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Architecture & Design](), [istio](), [Kubernetes](), [Cilium](), [eBPF](), [linkerd]() Tags: [architecture](), [cilium](), [ebpf](), [envoy](), [istio](), [kubernetes](), [linkerd](), [observability](), [proxy](), [security](), [service-mesh](), [sidecar](), [tls]() ### AI overview This article explains the core problems addressed by service meshes and examines the Sidecar architecture, including traffic interception, proxy processing, Envoy's xDS configuration model, and Istio's istiod control plane. It focuses on the performance and operational overhead of Sidecars and compares them with approaches such as Cilium's eBPF-based implementation and Istio Ambient Mesh. ### Source excerpt 2023 年，某头部电商平台在全量接入 Istio 后发现：每个 Pod 的内存占用增加了 40-70 MB，p99 延迟从 12 ms 上升到 18 ms，整个集群每月多出数万美元的计算成本。这并非个例。CNCF 2024 年度调查显示，超过 60% 的受访企业已在生产环境中使用或评估服务网格（Service Mes... ## Kubeflow Community Distribution 26.03.1 Release Announcement DevFeed: [Kubeflow Community Distribution 26.03.1 Release Announcement]() Original publisher: [Read original article]() Author: Kubeflow 26.03 Release Team Published: 2026-04-11T05:00:00Z Content type: release Language: en Sources: [Kubeflow]() Topics: [releases](), [Kubernetes](), [MinIO](), [istio](), [OpenID connect (OIDC)](), [kubectl]() Tags: [announcement](), [authentication](), [authorization](), [catalog](), [ci](), [istio](), [kubectl](), [kubernetes](), [minio](), [network](), [oidc](), [parallel](), [release](), [storage](), [ui](), [updates](), [versioning]() ### AI overview The Kubeflow Community Distribution 26.03.1 release introduces calendar-based versioning and updates components including Kubernetes, Kubeflow Pipelines, KServe, Trainer, notebooks, the dashboard, Istio, and related dependencies. It also adds native OIDC support, conditional and parallel Local Runner control flows, SeaweedFS storage support, and completes MinIO deprecation. ### Source excerpt The release versioning is now calendar-based (Year.Month.Patch). Around two base releases are planned per year with optional patch releases. The best-effort only community support is roughly 6 months and there is commercial support available from multiple vendors. Please update regularly as explained in our upgrading and extending section to benefit also from security and performance improvements. Release details: 26.03 and 26.03.1. ## How to Secure Microservices with SPIFFE and Istio DevFeed: [How to Secure Microservices with SPIFFE and Istio]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeff Ellin, Boris Kurktchiev) Published: 2026-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [istio](), [Microservices](), [SPIFFE](), [Zero Trust](), [Authorization](), [Architecture & Design](), [Secrets Management](), [certificates]() Tags: [architecture](), [authorization](), [backend](), [certificates](), [cloud-native](), [firewalls](), [how-to](), [istio](), [kubernetes](), [microservices](), [policies](), [secrets-management](), [security](), [service-mesh](), [spiffe](), [zero-trust]() ### AI overview This guide explains how to secure microservices with SPIFFE identities, Istio service-mesh mTLS, short-lived certificates, and Zero Trust authorization policies. It addresses the limits of network-based trust and long-lived certificates in dynamic Kubernetes environments. ### Source excerpt Learn how to deploy a secure microservices application, configure default-deny authorization policies, and rebuild service connectivity with SPIFFE-based allow rules. ## Migrating Chainguard's Serving Infrastructure to Cloud Run DevFeed: [Migrating Chainguard's Serving Infrastructure to Cloud Run]() Original publisher: [Read original article]() Published: 2024-12-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cloud Run](), [Kubernetes](), [chainguard](), [autoscaling]() Tags: [autoscaling](), [chainguard](), [cloud](), [cloud-run](), [github-actions](), [gke](), [go](), [istio](), [kubernetes](), [security](), [serving-architecture]() ### AI overview Chainguard migrated its serving platform from two regional GKE clusters running on Kubernetes to Cloud Run. The article previews the previous architecture and the operational pressures that motivated the change, including infrastructure complexity, unused development clusters, rising costs, slow node autoscaling, traffic spikes, and user-visible errors. ### Source excerpt Chainguard has migrated its serving platform from Kubernetes to Cloud Run. Take a peek at how we did it, and how it makes Chainguard a more secure place. ## Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users DevFeed: [Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users]() Original publisher: [Read original article]() Author: Nikhil Arora Published: 2024-07-03T15:52:26Z Content type: tutorial Language: en Sources: [Indeed]() Topics: [SPIRE](), [istio](), [Kubernetes](), [OpenID connect (OIDC)](), [Zero Trust](), [AWS Identity and Access Management (IAM)](), [Architecture & Design]() Tags: [authentication](), [authorization](), [aws-iam](), [credentials](), [guide](), [identity](), [istio](), [kubernetes](), [oidc](), [secrets](), [spire](), [unsorted](), [zero-trust]() ### AI overview This guide describes Indeed's approach to building a workload identity platform for Kubernetes and Istio using SPIRE and OIDC, with identities and access controls rooted in Zero Trust principles. It discusses credential risks, design choices, and implementation challenges for heterogeneous first-party and third-party workloads. ### Source excerpt Goal This blog is for engineering teams, architects, and leaders responsible for defining and implementing a workload identity platform and access controls rooted in Zero Trust principles to mitigate the risks from compromised services. It is relevant for companies using Kubernetes to manage workloads, using Istio for service mesh, and aiming to define identities in [...] ## Building application reliability on top of infrastructure unreliability DevFeed: [Building application reliability on top of infrastructure unreliability]() Original publisher: [Read original article]() Author: Fitz Published: 2024-01-12T07:00:00Z Content type: article Language: en Sources: [Temporal Blog]() Topics: [reliability](), [cloud-infrastructure](), [Microservice](), [Kubernetes](), [Architecture & Design](), [istio](), [Processes]() Tags: [databases](), [how-to](), [infrastructure](), [istio](), [kubernetes](), [microservices](), [networks](), [queues](), [reliability](), [software]() ### AI overview The article explains how application reliability can be built on infrastructure that is inherently unreliable. It discusses failures such as hardware faults, network outages, software patching, autoscaling termination, and abruptly ended processes, then introduces an e-commerce workflow whose apparently simple steps may span many microservices, databases, caches, event streams, and message queues. ### Source excerpt What do you do when you know, with absolute certainty, that the infrastructure you're running something on is unreliable? Hardware always fails eventually, networks go down, or software needs to be patched. ## Securing cloud native's most important use cases DevFeed: [Securing cloud native's most important use cases]() Original publisher: [Read original article]() Published: 2023-12-19T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Cloud](), [Cilium](), [Security](), [supply-chain-security](), [vulnerability management](), [Kubernetes](), [Platform Engineering]() Tags: [chainguard-images](), [cilium](), [cloud](), [cloud-native](), [container-image](), [container-images](), [istio](), [kubernetes](), [platform-engineering](), [security](), [software-supply-chain](), [vulnerability-management]() ### AI overview This article explains Chainguard's focus on securing cloud-native software supply chains while preserving developer experience. It introduces Chainguard Images bundles for Cilium and Istio, describing their use in Kubernetes environments and build pipelines. ### Source excerpt Chainguard Images now supports Cilium and Istio. See how to integrate our container images into your environments. ## How we scaled our Prometheus setup DevFeed: [How we scaled our Prometheus setup]() Original publisher: [Read original article]() Author: Simon Brüggen Professional Makefile guru; Jenkins wrangler Follow Published: 2022-08-23T00:00:00Z Content type: article Language: en Sources: [Trivago]() Topics: [Prometheus](), [Grafana](), [Node.js](), [GraphQL](), [Kubernetes](), [Microservices](), [Google Cloud Platform (GCP)](), [istio](), [Architecture & Design]() Tags: [cloud](), [cloud-storage](), [clusters](), [continuous-deployment](), [deployment](), [devops](), [gcp](), [grafana](), [graphql](), [istio](), [kubernetes](), [load](), [metric](), [metrics](), [microservices](), [monitoring](), [network](), [node-js](), [prometheus]() ### AI overview The article describes trivago's Prometheus monitoring architecture for a Node.js GraphQL API and its microservices running across three Google Kubernetes Engine regions. It explains the use of Prometheus, Thanos, Grafana, Istio, and Google Cloud Storage, and discusses scaling challenges as traffic and deployment activity increased. ### Source excerpt In 2020 we started to migrate one of our most significant workloads, our Node.js based GraphQL API and many of its microservices, from our datacenter to Google Kubernetes Engine. We deploy it in... ## Cross-Cluster Traffic Mirroring with Istio DevFeed: [Cross-Cluster Traffic Mirroring with Istio]() Original publisher: [Read original article]() Author: Mert Acikportali Published: 2020-06-10T00:00:00Z Content type: tutorial Language: en Sources: [Trivago]() Topics: [istio](), [Kubernetes](), [Deployment](), [Docker]() Tags: [backend](), [cloud](), [containerization](), [deployment](), [development](), [devops](), [docker](), [istio](), [kubernetes]() ### AI overview This tutorial explains how Istio can mirror live production traffic to another environment for developing and validating features. It presents traffic mirroring as an alternative to generating mock traffic, while noting that the mirrored traffic percentage can be configured through a parameter. ### Source excerpt The price of reliability is the pursuit of the utmost simplicity.-- C.A.R. Hoare, Turing Award lectureHave you ever enthusiastically released a new, delightful version to product... ## Keycloak and Istio DevFeed: [Keycloak and Istio]() Original publisher: [Read original article]() Author: Sébastien Blanc Published: 2018-02-26T00:00:00Z Content type: tutorial Language: en Sources: [Keycloak Blog]() Topics: [istio](), [Keycloak](), [JSON Web Tokens](), [Architecture & Design](), [proxy]() Tags: [envoy-proxy](), [http](), [idm](), [istio](), [jwt](), [kerberos](), [keycloak](), [ldap](), [load-balancing](), [openid-connect](), [proxy](), [saml](), [service-mesh](), [sso]() ### AI overview This short blog post describes early trials of combining Keycloak with Istio. It explains how Istio's Envoy sidecar and JWT authentication filter can take over some security tasks traditionally handled by Keycloak adapters, while noting that the replacement is not yet complete. ### Source excerpt This short blog post is to share the first trials of combining Keycloak with Istio. What is Istio? Istio is an platform that provides a common way to manage your service mesh. You may wonder what a service mesh is, well, it's an infrastructure layer dedicated to connect, secure and make reliable your different services. Istio, in the end, will be replacing all of our circuit-breakers, intelligent load balancing or metrics librairies, but also the way how two services will communicate in a secure way. And this is of course the interesting part for Keycloak. As you know Keycloak uses adapters for each of the application or service that it secures. These adapters make sure to perform the redirect if needed, to retrieve the public keys, to verify the JWT signature etc ... There are a lot of different adapters depending on the type of application or technology that is used : there are Java EE adapters, JavaScript adapters and we even have a NodeJS adapter. The end of the adapters? Following the Istio philosophy, these adapters would not be needed in the end because the Istio infrastructure will take care of the tasks the adapters were doing (signature verification etc ...). We are not yet there for now but in this post we will see what can already be done with Istio and how much it already can replace the role of the Adapters. The Envoy Sidecar We won't dive into the details on how Istio works but there is one main concept to understand around which Istio is articulated : the Envoy Sidecar. Envoy is a high performance proxy deployed alongside with each deployed service and this is the reason we call it a "sidecar". Envoy captures all incoming and outgoing traffic of its "companion" service, it can then apply some basic operations and also collect data and send it to a central point of decision, called the "mixer" in Istio. The conifugration of Envoy itself happens through the "pilot" an other Istio component. Envoy Filters To make it easier to add new functionnality to t