mTLS, traffic management, and zero-trust networking at the mesh layer
Day 1
Istio — Architecture, mTLS & Traffic Management
- Architecture: istiod (Pilot, Citadel, Galley unified), Envoy sidecar data plane, xDS protocol for config distribution
- mTLS: PERMISSIVE vs STRICT PeerAuthentication, automatic certificate rotation via istiod CA, SPIFFE identity
- VirtualServices: HTTP routing rules, header-based routing, weight-based traffic splitting for canary releases
- DestinationRules: subsets for stable/canary versions, connection pool settings, outlier detection (circuit breaking)
- Retries and timeouts: configuring retry attempts, per-try timeouts, and retry conditions at the mesh level
- Istio Gateway vs Kubernetes Ingress: Gateway and VirtualService for ingress, differences from standard Ingress resources
- Built-in observability: Prometheus metrics (Istio standard metrics), Grafana dashboards, Jaeger distributed tracing integration
Day 2
Linkerd & Advanced Istio — Authorization & Multi-Cluster
- Linkerd architecture: Rust-based micro-proxy (no Envoy), linkerd-proxy sidecar, control plane components
- Linkerd mTLS: automatic certificate injection, identity components, verifying mTLS with linkerd viz
- Traffic split for canary: SMI TrafficSplit in Linkerd, Flagger integration for automated canary analysis
- Linkerd vs Istio: performance benchmarks, operational complexity, feature surface, migration considerations
- Istio AuthorizationPolicy: ALLOW/DENY rules, principal-based (SPIFFE), namespace-based, and attribute-based policies
- RequestAuthentication: JWT validation at the mesh layer, integrating with OIDC providers
- Ambient mode: sidecarless Istio architecture (ztunnel L4, waypoint L7), migration from sidecar mode
What your team walks away with
Participants can deploy and operate a service mesh in production — enforcing mTLS, managing traffic for safe deployments, and building zero-trust authorization policies between services.
- Deploy and configure Istio for automatic mTLS, traffic management, and built-in observability
- Implement canary deployments at the mesh layer using VirtualService weight-based routing
- Configure service-to-service authorization policies based on SPIFFE identity and namespace boundaries
- Evaluate Istio vs Linkerd with a structured decision framework based on operational context and requirements
- Understand Istio Ambient mode as a migration path away from per-pod sidecar injection
Book the Service Mesh training
Reach out to schedule a session for your team — remote, on-site, or hybrid, in German or English.
Get in touch