# Resources — Istio & the Service Mesh

High-trust sources only. Every non-trivial claim in a lesson links to one of these. The
official Istio docs (istio.io) are the spine.

## Primary — official Istio docs (istio.io)

### Concepts & architecture
- **Architecture** — https://istio.io/latest/docs/ops/deployment/architecture/
  — data plane (Envoy sidecars) vs control plane (istiod). *(Lesson 1)*
- **Istio (overview / what it is)** — https://istio.io/latest/docs/overview/what-is-istio/ *(Lesson 1)*
- **Data plane modes (sidecar vs ambient)** — https://istio.io/latest/docs/overview/dataplane-modes/ *(Lesson 2)*
- **Installing the sidecar (injection)** — https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/
  — automatic injection via the `istio-injection` namespace label. *(Lesson 2)*

### Traffic management
- **Traffic Management (concept)** — https://istio.io/latest/docs/concepts/traffic-management/
  — Gateway / VirtualService / DestinationRule / ServiceEntry overview. *(Lessons 3–6)*
- **VirtualService (reference)** — https://istio.io/latest/docs/reference/config/networking/virtual-service/
  — match, route, rewrite, timeout, retries, weight. *(Lesson 4)*
- **Gateway (reference)** — https://istio.io/latest/docs/reference/config/networking/gateway/
  — ingress at the edge: hosts, servers, TLS. *(Lesson 5)*
- **DestinationRule (reference)** — https://istio.io/latest/docs/reference/config/networking/destination-rule/
  — subsets, trafficPolicy, load balancing, connection pool, outlier detection. *(Lesson 6)*
- **Traffic Management Best Practices** — https://istio.io/latest/docs/ops/best-practices/traffic-management/ *(Lessons 4–7)*

### Resilience
- **Circuit breaking / outlier detection** — https://istio.io/latest/docs/tasks/traffic-management/circuit-breaking/ *(Lesson 7)*
- **Request timeouts** — https://istio.io/latest/docs/tasks/traffic-management/request-timeouts/ *(Lesson 7)*

### Security
- **Security (concept)** — https://istio.io/latest/docs/concepts/security/
  — identity (SPIFFE), mTLS, authentication vs authorization. *(Lessons 9–10)*
- **PeerAuthentication (mTLS)** — https://istio.io/latest/docs/reference/config/security/peer_authentication/
  — STRICT / PERMISSIVE / DISABLE. *(Lesson 9)*
- **Authentication policy (task)** — https://istio.io/latest/docs/tasks/security/authentication/authn-policy/ *(Lesson 9)*
- **AuthorizationPolicy** — https://istio.io/latest/docs/reference/config/security/authorization-policy/
  — who may call what. *(Lesson 10)*

### Observability & extension
- **Observability (concept)** — https://istio.io/latest/docs/concepts/observability/ *(Lesson 11)*
- **Istio Standard Metrics** — https://istio.io/latest/docs/reference/config/metrics/
  — `istio_requests_total` and the golden-signal metrics. *(Lesson 11)*
- **Querying metrics from Prometheus** — https://istio.io/latest/docs/tasks/observability/metrics/querying-metrics/ *(Lesson 11)*
- **EnvoyFilter (reference)** — https://istio.io/latest/docs/reference/config/networking/envoy-filter/
  — the low-level escape hatch. *(Lesson 12)*

## Certification / structured learning
- **Istio Certified Associate (ICA)** — https://training.linuxfoundation.org/certification/istio-certified-associate-ica/
- **Istio "Getting Started"** — https://istio.io/latest/docs/setup/getting-started/

## Secondary — trusted explainers
- **Kube by Example — Istio traffic management** — https://kubebyexample.com/learning-paths/istio/traffic-management
- **Solo.io Istio topics** — https://www.solo.io/topics/istio/ (Solo employs many Istio maintainers).

## In-repo ground truth
- [reference/repo-istio-map.md](./reference/repo-istio-map.md) — the VirtualService/
  DestinationRule/Gateway templates, EnvoyFilters, mTLS policy, and the `istio_requests_total`
  → KEDA tie, with paths and line anchors.

## Communities (for wisdom)
- **Istio Slack** (slack.istio.io) — `#networking`, `#security` near the maintainers.
- **r/istio** / **CNCF Slack** — practical mesh Q&A.
- Internally: the team owning `deployments/helm/platforms/istio/` and the gateway — *why the
  mesh is configured this way* (mTLS mode, EnvoyFilters).