diff --git a/docs/README.md b/docs/README.md deleted file mode 100644 index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000 diff --git a/docs/monitoring.md b/docs/monitoring.md new file mode 100644 index 0000000000000000000000000000000000000000..f0b71abe86675e36739320bcfba48f1a3ef01756 --- /dev/null +++ b/docs/monitoring.md @@ -0,0 +1,11 @@ +# Monitoring + +The following links provide information on the various aspects of the monitoring and observability. +* [Monitoring with prometheus](https://istio.io/latest/docs/tasks/observability/metrics/). +* [Visualizing with Kiali](https://istio.io/latest/docs/tasks/observability/kiali/). +* [Distributed Tracing](https://istio.io/latest/docs/tasks/observability/distributed-tracing/jaeger/). + + +# Additional resources +* [Istio WorkShop - Observability](https://www.youtube.com/watch?v=7IXTiAkmt_Y&list=PLM4Db0UWu45LpokqVBFjfFYqQljPsqsd6&index=8&t=1515s) +* [Istio Observability](https://www.youtube.com/watch?v=nuyDNiAdeKM) diff --git a/docs/overview.md b/docs/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..db19e026e1060f6f140a1742aa191a57e0ca0554 --- /dev/null +++ b/docs/overview.md @@ -0,0 +1,28 @@ +# Service Mesh and Istio + +A service mesh is a dedicated infrastructure layer for making service-to-service communication safe, fast, and reliable, at times relying on a container orchestrator or integration with another service discovery system. Service meshes might deploy as a separate layer atop container orchestrators, but don’t require them, as control and data-plane components might be deployed independent of containerized infrastructure. Istio is able to do this using the envoy sidecar proxy which it auto injects into every application pod. + + +# Benefits of Istio + +* **Observability** + * Integrated Jaeger deployment for tracing. + * Integrated Kiali deployment for service to service traffic visibility. + * Integrated Prometheus deployment to scrape metrics. +* **Traffic control** + * Circuit breaking and retry logic. + * Canary and Dark releases. +* **Security** + * More granular fine grained security applied on service to service interaction. + * Mutual TLS can be applied at a cluster or namespace level. + * Programming intelligence/security into applications without intrusive instrumentation using sidecar proxy. + * Policy Standardization across the enterprise. + + +# Additional resources + +The following links provide more insight into the architecture and operations of Istio + +* [Let me sketch a mesh for you](https://www.youtube.com/watch?v=U0uoPKzZDEQ&list=PL7wB27eZmdffS-g_xh7X-b0echc_XZMKV&index=4) +* [istio explained in 15 mins](https://www.youtube.com/watch?v=16fgzklcF7Y) +* [what is istio](https://istio.io/v1.8/docs/concepts/what-is-istio/) \ No newline at end of file diff --git a/docs/security.md b/docs/security.md new file mode 100644 index 0000000000000000000000000000000000000000..8b197c17da3eaef177781bc34a014aae0164d85e --- /dev/null +++ b/docs/security.md @@ -0,0 +1,27 @@ +# Istio Security + +One of the main features of Istio is its baked in security features which applications are able to utilize without any additional instrumentation. This enables application developers to focus more on application features and offload security to Istio. + +Security implementation is made possible using the envoy sidecar proxy and the implemenation is done both at the edge of the mesh ( using the ingress gateway), or at the service layer within the cluster. + +# Authentication + +Istio has two main types of authentication it implements. +* [Peer authentication](https://istio.io/latest/docs/concepts/security/#peer-authentication) which applies to workloads (services) and manages MTLS settings. + + +* [Request authentication](https://istio.io/latest/docs/concepts/security/#request-authentication) which applies to JWTs. + +To get more information on how to configure them , refer to this [link](https://istio.io/latest/docs/tasks/security/authentication/authn-policy/). + +# Authorization + Istio is able to provide various levels of access control within the mesh. The levels include mesh wide , namespace wide and a more targeted workload policy. It is able to do this using an [Authorization Policy](https://istio.io/latest/docs/reference/config/security/authorization-policy/). + + More information on how to feaures and configuration of authorization policies is located [here](https://istio.io/latest/docs/tasks/security/authorization/). + + + # Additional resources + The following are addtional resources for learning about istio security. + + * [Improving security with Istio](https://www.youtube.com/watch?v=E0h1rS2D86k) + * [Istio Auto mTLS and JWT](https://www.youtube.com/watch?v=7_O58efytvM&t=422s) \ No newline at end of file diff --git a/docs/traffic-management.md b/docs/traffic-management.md new file mode 100644 index 0000000000000000000000000000000000000000..1b3823254dd068694229086543d3707895d619cb --- /dev/null +++ b/docs/traffic-management.md @@ -0,0 +1,31 @@ +Istio traffic management revolves around handling north-south traffic ( traffic in and out of the mesh ) and east-west traffic ( traffic between services the mesh ). Istio is able to auto detect services endpoints in a cluster and in turn , populates a service registry. + + + +The following API resources enable the configuration and adoption of Istio’s traffic management + + + +* [Virtual services ](https://istio.io/latest/docs/reference/config/networking/virtual-service/) which provides routing configuration to services within the mesh. +* [Destination rules](https://istio.io/latest/docs/reference/config/networking/destination-rule/) which allows you to provide routing to a subset of services and are paired with virtualservices. +* [Gateways](https://istio.io/latest/docs/reference/config/networking/gateway/) which are used to manage traffic entering or leaving the service mesh. +* [Service Entry](https://istio.io/latest/docs/reference/config/networking/service-entry/) which is used to add entries into the internal service registry. + + +Istio also have some advanced traffic management strategies like circuit breaking , mirroring and fault injection. Examples and walkthroughs can be found [here](https://istio.io/latest/docs/tasks/traffic-management/). + + + + + +# Additional resources + + + +The following additional resources are helpful in understanding traffic management. + + + +* [Istio in production - Traffic routing](https://www.youtube.com/watch?v=7cINRP0BFY8) +* [Istio traffic routing and resiliency ](https://www.youtube.com/watch?v=iLslUy2kTlw) +* [Istio ingress gateway](https://www.youtube.com/watch?v=ssqDgcEvdZ0&t=8s) diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md new file mode 100644 index 0000000000000000000000000000000000000000..773cafdc4eb7b59d3e0942147a89c7e1916f9eef --- /dev/null +++ b/docs/troubleshooting.md @@ -0,0 +1,21 @@ +# Common Problems + +While working with istio there are a few problems that can be encountered ranging from TLS configuration mistakes to routing rules not affecting traffic flow and a host of other issues. + +Some of the common issies are documented below + +* [Traffic Management Problems](https://istio.io/latest/docs/ops/common-problems/network-issues/) +* [Security Problems](https://istio.io/latest/docs/ops/common-problems/security-issues/) +* [Sidecar injection problems](https://istio.io/latest/docs/ops/common-problems/injection/) +* [Configuration Validation problems](https://istio.io/latest/docs/ops/common-problems/validation/) + +In addition to the common problems , the istio documentation provides a [diagnostics tool](https://istio.io/latest/docs/ops/diagnostic-tools/) page, which provides various command line tools and techniques for debugging your istio mesh. + +The following are also some additional external links that can help in debugging. + +# Additional links + +* [Istio Debugging](https://www.youtube.com/watch?v=QLuQB_JdzvU) +* [Debugging Istio within the Department of Defense](https://www.youtube.com/watch?v=bZO9iRW-V74) +* [How to debug your Istio networking configuration](https://www.tetrate.io/blog/debugging-your-istio-networking-configuration/) +* [What to do when your service mesh goes down in production](https://www.youtube.com/watch?v=XAKY24b7XjQ) \ No newline at end of file