Istio Service Mesh Workshop

Welcome to the Istio Service Mesh Workshop. This workshop is designed to help you understand, deploy, and manage Istio service mesh in your Kubernetes environment. Through hands-on exercises and detailed explanations, you will learn how to leverage Istio’s powerful features to enhance the security, observability, and reliability of your microservices architecture.

The exercises are written for Red Hat OpenShift Service Mesh 3.4, which is based on Istio 1.30.

Shared CLI tools image (OpenShift 102 Workshop)

If you prefer not to install the command-line tools on your laptop, run the workshop’s tools image on the cluster.

It has oc, kubectl, helm, istioctl, jq, yq, git, gpg, curl, wget, skopeo and a docker shim, and an interactive bash session lists them when it starts. You don’t need a local oc client to start it: apply the manifest below from the web console.

Image (change the tag to match the release you deployed):

ghcr.io/shpwrck/openshift-102-workshop-tools:v1.0.14

To start it from the web console:

  1. In the OpenShift web console, select your Project.

  2. Click + in the top bar, then Import YAML.

  3. Paste the manifest below, change its image: line if you mirror images, then click Create.

  4. Go to Workloads → Deployments → openshift-102-workshop-tools, open the Pods tab, select the running pod, then Terminal. Start bash if the terminal opens sh.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: openshift-102-workshop-tools
  labels:
    app.kubernetes.io/name: openshift-102-workshop-tools
    app.kubernetes.io/part-of: openshift-102-workshop
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: openshift-102-workshop-tools
  template:
    metadata:
      labels:
        app.kubernetes.io/name: openshift-102-workshop-tools
    spec:
      containers:
        - name: tools
          image: ghcr.io/shpwrck/openshift-102-workshop-tools:v1.0.14
          imagePullPolicy: IfNotPresent
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: "1"
              memory: 512Mi

The release’s offline bundle has the same manifest as tools-deployment.yaml, with TOOLS.md, which describes the image, and images-mirror.txt, which lists the images to mirror for a disconnected cluster. The pod keeps running until you delete the Deployment.

Commands in the pod act as the pod’s default ServiceAccount, which has no permissions in your project. Log in as yourself with oc login inside the pod first (in the web console, click your user name, then Copy login command), or ask a project admin to grant the ServiceAccount edit. If the login reports certificate signed by unknown authority, add --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt to it.

The workshop’s Helm chart, openshift-102-workshop, is in ~/chart in the pod. To install the site from the pod, into your existing project and without a second tools pod:

helm upgrade --install workshop ~/chart \
  --namespace <your-project> \
  --set tools.enabled=false

Leave out --create-namespace, which fails for users who can’t create projects.

The deployed site also serves the chart as a Helm chart repository at /helm/, so you can add it from a workstation without cloning the repository:

helm repo add openshift-102-workshop \
  https://<your-site-route>/helm/

There’s no container engine in the image. docker maps a few commands to skopeo: manifest inspect, pull (to a local directory), image inspect and history.

Prerequisites

This workshop assumes the following:

  • Basic understanding of Kubernetes concepts (pods, services, deployments)

  • Familiarity with containerization and microservices architecture

  • Access to an OpenShift cluster with OpenShift Service Mesh 3.4 and a prepared <user>-sandbox project

  • Command-line experience with oc (OpenShift CLI)

Instructors and cluster administrators: the cluster components, attendee projects and roles, workstation tools and images that the lab needs are listed in Setup Requirements.

If you are new to service meshes or Istio, we recommend reviewing the official Istio documentation before proceeding.

Workshop Structure

This workshop is divided into four modules:

  • Module 1: Overview - Introduction to Istio, Envoy, and sidecar architecture. Learn about the benefits of Istio, the strengths of Envoy proxy, and the basics of sidecar architecture. Hands-on exercises cover enabling sidecar injection and configuring mutual TLS (mTLS).

  • Module 2: Traffic Management - Learn how traffic enters the mesh through Gateways and how VirtualServices route traffic within the mesh. Exercises include creating Gateways, implementing path-based routing, weighted traffic splitting for canary deployments, and combining Gateways with VirtualServices.

  • Module 3: Advanced Traffic Management and Security - Explore advanced DestinationRule features including load balancing, failover, and circuit breaking. Learn how to implement request authentication with JWT and create authorization policies for fine-grained access control.

  • Module 4: Observability - Understand how Istio provides metrics, traces, and logs in standard formats. Learn to access Envoy metrics and logs directly from sidecar proxies, and explore observability data using built-in Istio tools without external dependencies.

Learning Objectives

After completing this workshop, you will be able to:

  • Understand the core concepts and benefits of service mesh technology, including Istio and Envoy

  • Enable sidecar injection and configure mutual TLS (mTLS) for secure service-to-service communication

  • Create and configure Gateways to manage external traffic entry points

  • Implement VirtualServices for sophisticated traffic routing, including path-based routing and weighted traffic splitting

  • Configure DestinationRules for load balancing, failover, and circuit breaking

  • Implement request authentication and authorization policies to secure your services

  • Access and analyze metrics and logs directly from Envoy sidecar proxies

  • Use Istio’s built-in observability features to monitor and troubleshoot your service mesh

  • Troubleshoot common issues and optimize Istio configurations