Course 4 of 7 · The deployment/infra track

Istio & the service mesh, from newcomer to interview-ready

How traffic flows between and into this repo's services — routed, secured, and observed.

Course 2 gave you a Kubernetes Service (a stable name over Pods, basic L4 load-balancing). But that can't do request routing, retries, mutual TLS, or per-request metrics. This repo layers Istio — a service mesh — on top for all of that. It's a big surface here: ~571 VirtualServices, an ingress gateway, DestinationRules, EnvoyFilters, and the istio_requests_total metric that already drives your KEDA autoscaling. Three parts, built one at a time. Lessons are short — one win each. Read them in order.

How to use this Do one lesson, take its quiz from memory (no peeking), then skim the matching row of the cheat sheet. Come back a day later and re-take it — spacing beats cramming. Your ninth course; you know the rhythm. Stuck? Ask me — I'm your teacher, not just the author.
Where Istio sits in the stack Kubernetes gives you Services (L4). Istio adds an L7 layer — routing, security, telemetry — via a sidecar proxy next to every Pod. Helm (Course 3) generates the Istio config objects. So this course builds directly on the last two.

Part 1 — Service-mesh fundamentals available now

What a mesh is, how the sidecar works, and the resources that route traffic.

1 · What a service mesh is

The sidecar/Envoy data plane vs the istiod control plane — capabilities without code.

ready

2 · The sidecar & injection

How Envoy is injected and transparently intercepts a Pod's traffic.

ready

3 · The three traffic resources

Gateway, VirtualService, DestinationRule — who governs what.

ready

4 · VirtualService

match / route / rewrite / timeout / retries — and this repo's route tables.

ready

Part 2 — Traffic, the edge & resilience available now

Getting traffic into the mesh, shaping it, and surviving failure.

5 · Gateway & ingress

The istio-ingressgateway edge (TLS) and the real request path — why gandalf isn't it.

ready

6 · DestinationRule & subsets

Load balancing, subsets, connection pools — and tom's chat session affinity.

ready

7 · Resilience

Timeouts, retries, circuit breaking, outlier detection — and what the repo tunes.

ready

8 · EnvoyFilter — the escape hatch

Low-level Envoy tweaks — the repo's Salesforce/Hasura Lua filters.

ready

Part 3 — Security, telemetry & operations available now

The security model (and why this repo opts out of parts of it), telemetry, and running the mesh.

9 · mTLS & identity

PeerAuthentication, SPIFFE, istiod as CA — the concept, and why this mesh has it off.

ready

10 · AuthorizationPolicy & edge auth

Who may call what — vs this repo's in-app auth choice.

ready

11 · Observability

istio_requests_total from the sidecar → Prometheus → KEDA + alerts.

ready

12 · Operations & the mesh's shape

ServiceEntry, egress-limiting Sidecar, injection gotchas — what this mesh is for.

ready

Reference shelf

Cheat sheet

Dense revision sheet + istioctl + interview one-liners.

Glossary

The canonical vocabulary, opinionated.

Repo Istio map

Ground truth: VS/DR/Gateway templates, EnvoyFilters, mTLS.

Resources

istio.io docs, the ICA cert.
All 12 lessons are built — the Istio course is complete. From the sidecar/ istiod model through traffic management to security & observability, you can now read this repo's mesh accurately — including the rarer skill of naming what a real mesh does and doesn't use. Next: Course 5 (CI/CD) — how all this config reaches the clusters. Or — ten courses' worth of lessons, still no retention check — ask me to run a mock interview and I'll record where you're solid.