Course 4 of 7 · The deployment/infra track
Istio & the service mesh, from newcomer to interview-ready
How traffic flows between and into this repo's services — routed, secured, and observed.
Course 2 gave you a Kubernetes Service (a stable name over Pods, basic L4
load-balancing). But that can't do request routing, retries, mutual TLS, or per-request
metrics. This repo layers Istio — a service mesh — on top for all of that.
It's a big surface here: ~571 VirtualServices, an ingress gateway,
DestinationRules, EnvoyFilters, and the istio_requests_total metric that already
drives your KEDA autoscaling. Three parts, built one at a time. Lessons are short — one win
each. Read them in order.
Part 1 — Service-mesh fundamentals available now
What a mesh is, how the sidecar works, and the resources that route traffic.
1 · What a service mesh is
The sidecar/Envoy data plane vs the istiod control plane — capabilities without code.
ready2 · The sidecar & injection
How Envoy is injected and transparently intercepts a Pod's traffic.
ready3 · The three traffic resources
Gateway, VirtualService, DestinationRule — who governs what.
ready4 · VirtualService
match / route / rewrite / timeout / retries — and this repo's route tables.
readyPart 2 — Traffic, the edge & resilience available now
Getting traffic into the mesh, shaping it, and surviving failure.
5 · Gateway & ingress
The istio-ingressgateway edge (TLS) and the real request path — why gandalf isn't it.
6 · DestinationRule & subsets
Load balancing, subsets, connection pools — and tom's chat session affinity.
ready7 · Resilience
Timeouts, retries, circuit breaking, outlier detection — and what the repo tunes.
ready8 · EnvoyFilter — the escape hatch
Low-level Envoy tweaks — the repo's Salesforce/Hasura Lua filters.
readyPart 3 — Security, telemetry & operations available now
The security model (and why this repo opts out of parts of it), telemetry, and running the mesh.
9 · mTLS & identity
PeerAuthentication, SPIFFE, istiod as CA — the concept, and why this mesh has it off.
ready10 · AuthorizationPolicy & edge auth
Who may call what — vs this repo's in-app auth choice.
ready11 · Observability
istio_requests_total from the sidecar → Prometheus → KEDA + alerts.
12 · Operations & the mesh's shape
ServiceEntry, egress-limiting Sidecar, injection gotchas — what this mesh is for.
readyPart 4 — Senior Istio judgment new
The senior stretch — mesh truthfulness, edge-boundary realism, routing/security trade-offs, telemetry value, and interview-grade answers.
13 · Istio truthfulness
Tell the real mesh story accurately: what the mesh truly owns here, what it does not, and why that boundary matters.
new14 · Gateway boundary
Reason clearly about the edge, TLS termination, the real request path, and why gandalf is not the ingress gateway.
new15 · VS/DR realism
Separate routing power from local reality: route-table generation, subsets, defaults, and overclaiming risk.
new16 · Security posture realism
Explain conceptual Istio security honestly while keeping the repo’s edge-first, mostly opt-out backend posture front and center.
new17 · Observability & EnvoyFilter
Connect sidecar telemetry to KEDA and explain when low-level proxy power becomes operational drag.
new18 · Senior interview questions
High-signal Istio questions with answer shapes that sound like real operational experience.
new19 · Mock senior interview pack
A retrieval-first mock round with scoring and strong answer points.
newReference shelf
Cheat sheet
Dense revision sheet + istioctl + interview one-liners.
Glossary
The canonical vocabulary, opinionated.
Repo Istio map
Ground truth: VS/DR/Gateway templates, EnvoyFilters, mTLS.
Resources
istio.io docs, the ICA cert, plus senior mesh-judgment topics.
Senior backend playbook
The compressed version of the new senior part: truthfulness, edge boundaries, routing/security realism, telemetry trade-offs, and interview answers.