Split View: Service Mesh 완전 가이드 2025: Istio vs Linkerd, mTLS, 트래픽 관리, Observability

┌─────────────────────────────────────────────┐
│                   Pod                        │
│  ┌─────────────┐    ┌─────────────────────┐ │
│  │  Application │◄──►│   Sidecar Proxy     │ │
│  │  Container   │    │  (Envoy/linkerd2)   │ │
│  └─────────────┘    └─────────────────────┘ │
└─────────────────────────────────────────────┘

# Key functions managed by Istiod
- Service discovery: Syncs service list from Kubernetes API
- Configuration distribution: Converts VirtualService, DestinationRule to Envoy config
- Certificate management: Issues/renews mTLS certificates (built-in CA)
- Policy enforcement: Distributes AuthorizationPolicy, PeerAuthentication

# Linkerd control plane components
- destination: Service discovery + policy distribution
- identity: mTLS certificate issuance (trust anchor based)
- proxy-injector: Automatic sidecar injection on Pod creation
- heartbeat: Telemetry collection

# Install Istio (istioctl)
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.24.0
export PATH=$PWD/bin:$PATH

# Profile-based installation
istioctl install --set profile=demo -y

# Enable automatic sidecar injection for namespace
kubectl label namespace default istio-injection=enabled

# Envoy core features
- HTTP/1.1, HTTP/2, gRPC support
- Automatic retries and circuit breaking
- Dynamic configuration updates (xDS API)
- Rich metrics and tracing
- WebAssembly (Wasm) extension support
- Hot restart (graceful restart)

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-route
spec:
  hosts:
    - reviews
  http:
    # Canary deployment: 90% v1, 10% v2
    - route:
        - destination:
            host: reviews
            subset: v1
          weight: 90
        - destination:
            host: reviews
            subset: v2
          weight: 10
      timeout: 5s
      retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: 5xx,reset,connect-failure

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-destination
spec:
  host: reviews
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
    loadBalancer:
      simple: LEAST_REQUEST
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: bookinfo-cert
      hosts:
        - "bookinfo.example.com"

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  # Apply STRICT mTLS across the mesh
  mtls:
    mode: STRICT
---
# PERMISSIVE mode for specific namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: legacy-compat
  namespace: legacy-apps
spec:
  mtls:
    mode: PERMISSIVE

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: reviews-viewer
  namespace: default
spec:
  selector:
    matchLabels:
      app: reviews
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/productpage"]
      to:
        - operation:
            methods: ["GET"]
            paths: ["/reviews/*"]

# Install Linkerd CLI
curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh
export PATH=$HOME/.linkerd2/bin:$PATH

# Pre-flight checks
linkerd check --pre

# Install
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -

# Verify
linkerd check

# Viz extension (dashboard + metrics)
linkerd viz install | kubectl apply -f -

Performance Comparison (linkerd2-proxy vs Envoy)
========================================
Memory usage:    ~20MB vs ~50-100MB
P99 latency:     ~1ms added vs ~2-5ms added
Binary size:     ~13MB vs ~50MB
Security:        Rust memory safety guaranteed
Feature scope:   Service Mesh dedicated vs general-purpose proxy

apiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
  name: webapp.default.svc.cluster.local
  namespace: default
spec:
  routes:
    - name: GET /api/users
      condition:
        method: GET
        pathRegex: /api/users
      responseClasses:
        - condition:
            status:
              min: 500
              max: 599
          isFailure: true
    - name: POST /api/orders
      condition:
        method: POST
        pathRegex: /api/orders
      isRetryable: true
      timeout: 10s

apiVersion: split.smi-spec.io/v1alpha4
kind: TrafficSplit
metadata:
  name: webapp-split
  namespace: default
spec:
  service: webapp
  backends:
    - service: webapp-v1
      weight: 900
    - service: webapp-v2
      weight: 100

# Install multi-cluster extension
linkerd multicluster install | kubectl apply -f -

# Link remote cluster
linkerd multicluster link --cluster-name=west \
  --api-server-address="https://west.example.com:6443" | \
  kubectl apply -f -

# Verify service mirroring
linkerd multicluster gateways

Service A (client)              Service B (server)
     |                            |
     |-- ClientHello -----------> |
     |<- ServerHello + ServerCert |
     |-- Client Certificate ----> |
     |<- Certificate Verified --- |
     |                            |
     |<=== Encrypted Traffic ===> |

SPIFFE ID format:
spiffe://cluster.local/ns/NAMESPACE/sa/SERVICE_ACCOUNT

Examples:
spiffe://cluster.local/ns/production/sa/frontend
spiffe://cluster.local/ns/production/sa/backend-api

# Istio: Certificate lifetime configuration (MeshConfig)
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      # Default workload certificate is 24 hours
      # Customizable through proxyMetadata
    certificates: []
  values:
    pilot:
      env:
        # Maximum certificate lifetime
        MAX_WORKLOAD_CERT_TTL: "48h"
        # Default certificate lifetime
        DEFAULT_WORKLOAD_CERT_TTL: "24h"

# Create trust anchor (10-year lifetime)
step certificate create root.linkerd.cluster.local ca.crt ca.key \
  --profile root-ca --no-password --insecure --not-after=87600h

# Create issuer certificate (48-hour lifetime, auto-renewed)
step certificate create identity.linkerd.cluster.local issuer.crt issuer.key \
  --profile intermediate-ca --not-after=48h --no-password --insecure \
  --ca ca.crt --ca-key ca.key

# Install with certificates
linkerd install \
  --identity-trust-anchors-file ca.crt \
  --identity-issuer-certificate-file issuer.crt \
  --identity-issuer-key-file issuer.key | kubectl apply -f -

# Istio - Progressive canary deployment
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            x-canary-user:
              exact: "true"
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1
          weight: 95
        - destination:
            host: reviews
            subset: v2
          weight: 5

apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: reviews
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: reviews
  service:
    port: 9080
  analysis:
    interval: 1m
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
      - name: request-success-rate
        thresholdRange:
          min: 99
        interval: 1m
      - name: request-duration
        thresholdRange:
          max: 500
        interval: 1m

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-mirror
spec:
  hosts:
    - reviews
  http:
    - route:
        - destination:
            host: reviews
            subset: v1
      mirror:
        host: reviews
        subset: v2
      mirrorPercentage:
        value: 100.0

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ratings-fault
spec:
  hosts:
    - ratings
  http:
    - fault:
        delay:
          percentage:
            value: 10
          fixedDelay: 5s
        abort:
          percentage:
            value: 5
          httpStatus: 503
      route:
        - destination:
            host: ratings

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-circuit-breaker
spec:
  host: reviews
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 50
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 100
        maxRequestsPerConnection: 10
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 30
      minHealthPercent: 70

# Istio
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-retry
spec:
  hosts:
    - reviews
  http:
    - timeout: 10s
      retries:
        attempts: 3
        perTryTimeout: 3s
        retryOn: 5xx,reset,connect-failure,retriable-4xx
      route:
        - destination:
            host: reviews

# Linkerd ServiceProfile
apiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
  name: reviews.default.svc.cluster.local
spec:
  routes:
    - name: GET /reviews
      condition:
        method: GET
        pathRegex: /reviews/.*
      isRetryable: true
      timeout: 10s

Golden Signals
================================
1. Latency: Request processing time
2. Traffic: Requests per second
3. Error rate: Percentage of failed requests
4. Saturation: Resource utilization

Istio key metrics:
- istio_requests_total: Total request count (by source, destination, response code)
- istio_request_duration_milliseconds: Request duration
- istio_request_bytes / istio_response_bytes: Request/response sizes

Linkerd key metrics:
- request_total: Total request count
- response_latency_ms: Response latency
- tcp_open_total: TCP connection count

# Prometheus scraping configuration (Istio)
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
data:
  prometheus.yml: |
    scrape_configs:
      - job_name: 'envoy-stats'
        metrics_path: /stats/prometheus
        kubernetes_sd_configs:
          - role: pod
        relabel_configs:
          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
            action: keep
            regex: true

# Istio telemetry configuration
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  tracing:
    - providers:
        - name: jaeger
      randomSamplingPercentage: 10
      customTags:
        environment:
          literal:
            value: "production"

Tracing headers to propagate:
- x-request-id
- x-b3-traceid
- x-b3-spanid
- x-b3-parentspanid
- x-b3-sampled
- x-b3-flags
- traceparent (W3C Trace Context)
- tracestate

# Install Kiali
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/addons/kiali.yaml

# Access dashboard
istioctl dashboard kiali

# Install Grafana + pre-configured dashboards
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/addons/grafana.yaml

# Access dashboard
istioctl dashboard grafana

# GatewayClass: Defined by infrastructure admin
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: istio
spec:
  controllerName: istio.io/gateway-controller
---
# Gateway: Defined by cluster admin
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  gatewayClassName: istio
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: bookinfo-tls
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              expose: "true"
---
# HTTPRoute: Defined by application developer
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: bookinfo-route
spec:
  parentRefs:
    - name: bookinfo-gateway
  hostnames:
    - "bookinfo.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /reviews
      backendRefs:
        - name: reviews
          port: 9080
          weight: 90
        - name: reviews-v2
          port: 9080
          weight: 10

Legacy Istio approach:
  Gateway + VirtualService + DestinationRule

Kubernetes Gateway API approach:
  GatewayClass + Gateway + HTTPRoute

Benefits:
  - Standardized API (portability across implementations)
  - Role-based access control
  - Better namespace isolation
  - Same API usable across Istio, Linkerd, Cilium, etc.

Traditional Sidecar Mode:
+--------------+    +--------------+
| App + Envoy  |--->| App + Envoy  |
+--------------+    +--------------+

Ambient Mesh Mode:
+--------------+    +--------------+
|     App      |    |     App      |
+------+-------+    +-------+------+
       |                    |
+------+--------------------+------+  <-- ztunnel (1 per node, L4)
+------------------+---------------+
                   |
            +------+------+          <-- waypoint proxy (optional, L7)
            |   Waypoint  |
            +-------------+

# Install Istio in Ambient mode
istioctl install --set profile=ambient -y

# Add namespace to Ambient mesh
kubectl label namespace default istio.io/dataplane-mode=ambient

# Deploy Waypoint Proxy (when L7 features needed)
istioctl waypoint apply --namespace default --name reviews-waypoint

Resource Savings Comparison (100-Pod cluster):
========================================
                Sidecar Mode     Ambient Mode
Memory:         5-10GB added     200-500MB added
CPU:            Significant      Minimal overhead
Operations:     Manage sidecars  Only ztunnel DaemonSet
Upgrades:       Pod restart      ztunnel rolling update

# Namespace-level deny policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  # Empty rules deny all requests
  {}
---
# Allow specific services only
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend-to-api
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-server
  action: ALLOW
  rules:
    - from:
        - source:
            namespaces: ["production"]
            principals: ["cluster.local/ns/production/sa/frontend"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/v1/*"]
      when:
        - key: request.headers[x-api-version]
          values: ["v1", "v2"]

# RequestAuthentication: Define JWT validation
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-server
  jwtRules:
    - issuer: "https://auth.example.com"
      jwksUri: "https://auth.example.com/.well-known/jwks.json"
      forwardOriginalToken: true
      outputPayloadToHeader: "x-jwt-payload"
---
# JWT claims-based authorization
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-server
  action: ALLOW
  rules:
    - from:
        - source:
            requestPrincipals: ["https://auth.example.com/*"]
      when:
        - key: request.auth.claims[role]
          values: ["admin", "editor"]

# External authorization service integration
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ext-authz
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-server
  action: CUSTOM
  provider:
    name: "opa-ext-authz"
  rules:
    - to:
        - operation:
            paths: ["/admin/*"]

# Register external authz provider in MeshConfig
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    extensionProviders:
      - name: "opa-ext-authz"
        envoyExtAuthzGrpc:
          service: "opa.opa-system.svc.cluster.local"
          port: 9191
          includeRequestBodyInCheck:
            maxRequestBytes: 1024

# Istio sidecar resource limits
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      concurrency: 2
  values:
    global:
      proxy:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 256Mi

# Step 1: PERMISSIVE mTLS (allow legacy traffic)
kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: PERMISSIVE
EOF

# Step 2: Monitor metrics (check mTLS traffic ratio)
# Check connection_security_policy in istio_requests_total metric

# Step 3: Switch to STRICT mTLS
kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: STRICT
EOF

# Check Istio proxy status
istioctl proxy-status

# Dump Envoy configuration
istioctl proxy-config all POD_NAME -o json

# Check routing rules
istioctl proxy-config route POD_NAME

# Check cluster configuration
istioctl proxy-config cluster POD_NAME

# Analysis tool (detect config errors)
istioctl analyze --all-namespaces

# Linkerd diagnostics
linkerd check
linkerd diagnostics proxy-metrics POD_NAME
linkerd viz stat deploy
linkerd viz top deploy/webapp
linkerd viz tap deploy/webapp

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: reviews-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: reviews
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Pods
      pods:
        metric:
          name: istio_requests_per_second
        target:
          type: AverageValue
          averageValue: "100"
    - type: Pods
      pods:
        metric:
          name: istio_request_duration_milliseconds_p99
        target:
          type: AverageValue
          averageValue: "500"

# Istio canary upgrade
# 1. Install new version control plane (revision-based)
istioctl install --set revision=1-24-0

# 2. Gradually switch by changing namespace labels
kubectl label namespace default istio.io/rev=1-24-0 --overwrite

# 3. Restart Pods to apply new proxy
kubectl rollout restart deployment -n default

# 4. Remove previous version
istioctl uninstall --revision 1-23-0

Simple mTLS only: cert-manager + service-level TLS
Basic observability: Direct OpenTelemetry instrumentation
Simple load balancing: Kubernetes Service (ClusterIP)
Ingress only: NGINX Ingress Controller or Traefik
Network policies: Kubernetes NetworkPolicy or Cilium