Istio Traffic Policy Builder

A VirtualService defines how traffic is routed to a Kubernetes service. Unlike a Kubernetes Service (which is just a stable IP), a VirtualService lets you split traffic by percentage, match on HTTP headers/paths/methods, apply retries, timeouts, and fault injection. It's the core traffic management primitive in Istio.

A DestinationRule configures policies applied to traffic after routing: load balancing strategy, connection pool settings, circuit breaker (outlier detection), and TLS mode. You also use it to define subsets — named groups of pods selected by labels (e.g. version: v1 vs version: v2). VirtualService references these subsets for weighted routing (canary deployments).

Deploy both v1 and v2 of your app with different labels (e.g. version: v1, version: v2). Create a DestinationRule defining two subsets based on those labels. Then use a VirtualService to split traffic: send 90% to subset v1 and 10% to v2. Gradually shift traffic to v2 (10→25→50→100%) as you gain confidence, with instant rollback by changing the weight back to 0.

Fault injection tests your system's resilience by deliberately introducing failures. Istio supports two types: (1) HTTP delay — adds latency to a percentage of requests to test timeout handling, and (2) HTTP abort — returns error codes (e.g. 503) to test circuit breakers and retry logic. Unlike chaos engineering tools that affect infrastructure, Istio faults are applied at the proxy level with no code changes.

Retries automatically re-send failed requests (up to N times, with backoff). They handle transient failures but can amplify load during outages. Circuit breakers (outlier detection in Istio) track error rates per endpoint and temporarily eject unhealthy hosts from the load balancer pool — preventing overload. Use both: retries for occasional failures, circuit breaker to protect against cascading failures.

No, but Istio makes it much easier. Without Istio, canary routing depends on Kubernetes Service selector (which is binary — all traffic or none), so you'd need to manually scale replicas to approximate traffic percentages. Istio decouples traffic weight from replica count, enabling precise percentages regardless of pod count.