Global Mesh Options

Configuration affecting the service mesh as a whole.

AuthenticationPolicy

AuthenticationPolicy defines authentication policy. It can be set fordifferent scopes (mesh, service …), and the most narrow scope withnon-INHERIT value will be used.Mesh policy cannot be INHERIT.

Certificate

Certificate configures the provision of a certificate and its key.Example 1: key and cert stored in a secret{ secretName: galley-certsecretNamespace: istio-systemdnsNames:- galley.istio-system.svc- galley.mydomain.com}Example 2: key and cert stored in a directory{ dnsNames:- pilot.istio-system- pilot.istio-system.svc- pilot.mydomain.com}

ConfigSource

ConfigSource describes information about a configuration store inside amesh. A single control plane instance can interact with one or more datasources.

LocalityLoadBalancerSetting

Locality-weighted load balancing allows administrators to control thedistribution of traffic to endpoints based on the localities of where thetraffic originates and where it will terminate. These localities arespecified using arbitrary labels that designate a hierarchy of localities in{region}/{zone}/{sub-zone} form. For additional detail refer toLocality WeightThe following example shows how to setup locality weights mesh-wide.

Given a mesh with workloads and their service deployed to “us-west/zone1/”and “us-west/zone2/”. This example specifies that when traffic accessing aservice originates from workloads in “us-west/zone1/”, 80% of the trafficwill be sent to endpoints in “us-west/zone1/”, i.e the same zone, and theremaining 20% will go to endpoints in “us-west/zone2/”. This setup isintended to favor routing traffic to endpoints in the same locality.A similar setting is specified for traffic originating in “us-west/zone2/”.

  distribute:
    - from: us-west/zone1/*
      to:
        "us-west/zone1/*": 80
        "us-west/zone2/*": 20
    - from: us-west/zone2/*
      to:
        "us-west/zone1/*": 20
        "us-west/zone2/*": 80

If the goal of the operator is not to distribute load across zones andregions but rather to restrict the regionality of failover to meet otheroperational requirements an operator can set a ‘failover’ policy instead ofa ‘distribute’ policy.

The following example sets up a locality failover policy for regions.Assume a service resides in zones within us-east, us-west & eu-westthis example specifies that when endpoints within us-east become unhealthytraffic should failover to endpoints in any zone or sub-zone within eu-westand similarly us-west should failover to us-east.

 failover:
   - from: us-east
     to: eu-west
   - from: us-west
     to: us-east

Locality load balancing settings.

LocalityLoadBalancerSetting.Distribute

Describes how traffic originating in the ‘from’ zone or sub-zone isdistributed over a set of ‘to’ zones. Syntax for specifying a zone is{region}/{zone}/{sub-zone} and terminal wildcards are allowed on anysegment of the specification. Examples: - matches all localitiesus-west/ - all zones and sub-zones within the us-west regionus-west/zone-1/* - all sub-zones within us-west/zone-1

LocalityLoadBalancerSetting.Failover

Specify the traffic failover policy across regions. Since zone and sub-zonefailover is supported by default this only needs to be specified forregions when the operator needs to constrain traffic failover so thatthe default behavior of failing over to any endpoint globally does notapply. This is useful when failing over traffic across regions would notimprove service health or may need to be restricted for other reasonslike regulatory controls.

MeshConfig

MeshConfig defines mesh-wide variables shared by all Envoy instances in theIstio service mesh.

NOTE: This configuration type should be used for the low-level globalconfiguration, such as component addresses and port numbers. It should notbe used for the features of the mesh that can be scoped by service or bynamespace. Some of the fields in the mesh config are going to be deprecatedand replaced with several individual configuration types (for example,tracing configuration).

trustDomain: td1trustDomainAliases: ["td2", "td3"]

MeshConfig.AccessLogEncoding

MeshConfig.H2UpgradePolicy

Default Policy for upgrading http1.1 connections to http2.

MeshConfig.IngressControllerMode

MeshConfig.OutboundTrafficPolicy

MeshConfig.OutboundTrafficPolicy.Mode

MeshNetworks

MeshNetworks (config map) provides information about the set of networksinside a mesh and how to route to endpoints in each network. For example

MeshNetworks(file/config map):

networks:
  network1:
  - endpoints:
    - fromRegistry: registry1 #must match kubeconfig name in Kubernetes secret
    - fromCidr: 192.168.100.0/22 #a VM network for example
    gateways:
    - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
      port: 15443
      locality: us-east-1a
    - address: 192.168.100.1
      port: 15443
      locality: us-east-1a

Network

Network provides information about the endpoints in a routable L3network. A single routable L3 network can have one or more serviceregistries. Note that the network has no relation to the locality of theendpoint. The endpoint locality will be obtained from the serviceregistry.

Network.IstioNetworkGateway

The gateway associated with this network. Traffic from remote networkswill arrive at the specified gateway:port. All incoming traffic mustuse mTLS.

Network.NetworkEndpoints

NetworkEndpoints describes how the network associated with an endpointshould be inferred. An endpoint will be assigned to a network based onthe following rules:

• Implicitly: If the registry explicitly provides information aboutthe network to which the endpoint belongs to. In some cases, itspossible to indicate the network associated with the endpoint byadding the ISTIO_META_NETWORK environment variable to the sidecar.

• Explicitly:

a. By matching the registry name with one of the “fromRegistry”in the mesh config. A “from_registry” can only be assigned to asingle network.

b. By matching the IP against one of the CIDR ranges in a meshconfig network. The CIDR ranges must not overlap and be assigned toa single network.

(2) will override (1) if both are present.

ProxyConfig

ProxyConfig defines variables for individual Envoy instances.

ProxyConfig.InboundInterceptionMode

The mode used to redirect inbound traffic to Envoy.This setting has no effect on outbound traffic: iptables REDIRECT is always used foroutbound connections.

RemoteService

Resource

Resource describes the source of configuration

SDS

SDS defines secret discovery service(SDS) configuration to be used by the proxy.For workload, its values are set in sidecar injector(passed as arguments to istio-proxy container).For pilot/mixer, it’s passed as arguments to istio-proxy container in pilot/mixer deployment yaml files directly.

Tracing

Tracing defines configuration for the tracing performed by Envoy instances.

Tracing.Datadog

Datadog defines configuration for a Datadog tracer.

Tracing.Lightstep

Defines configuration for a LightStep tracer.

Tracing.Stackdriver

Stackdriver defines configuration for a Stackdriver tracer.See Opencensus trace config for details.

Tracing.Zipkin

Zipkin defines configuration for a Zipkin tracer.