Resilience, Security & Observability

Circuit Breaking & Fault Injection

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: payments
spec:
  host: payments
  trafficPolicy:
    outlierDetection:      # circuit breaker — ejects a consistently-failing
      consecutive5xxErrors: 5   # instance from the load-balancing pool
      interval: 30s
      baseEjectionTime: 60s
---
# Fault injection — test resilience WITHOUT actually breaking anything
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: payments-test
spec:
  hosts: [payments]
  http:
    - fault:
        delay: { percentage: { value: 10 }, fixedDelay: 5s }
      route:
        - destination: { host: payments }

Authorization Policies

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: payments-policy
  namespace: payments
spec:
  selector:
    matchLabels: { app: payments }
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/checkout/sa/checkout-service"]
      # Only the checkout service's identity may call payments —
      # a zero-trust rule enforced independent of application code

Ingress Gateway

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: main-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port: { number: 443, name: https, protocol: HTTPS }
      hosts: ["api.example.com"]
# A VirtualService then routes THIS external traffic to internal services,
# same mechanism as internal routing.

Observability & Trade-offs

Since all traffic already flows through sidecars, Istio captures metrics/tracing/service-dependency data automatically with zero app instrumentation. The cost: an Envoy sidecar per pod (CPU/memory overhead) and an extra network hop per request — usually single-digit milliseconds, worth benchmarking for latency-critical services before committing mesh-wide.