Split View: Istio 아키텍처 내부 분석: 컨트롤 플레인과 데이터 플레인

┌─────────────────────────────────────────────────┐
│                Control Plane                     │
│  ┌───────────────────────────────────────────┐  │
│  │              istiod                        │  │
│  │  ┌─────────┐ ┌─────────┐ ┌──────────┐   │  │
│  │  │  Pilot  │ │ Citadel │ │  Galley  │   │  │
│  │  │  (xDS)  │ │  (CA)   │ │(Validate)│   │  │
│  │  └─────────┘ └─────────┘ └──────────┘   │  │
│  └───────────────────────────────────────────┘  │
├─────────────────────────────────────────────────┤
│                Data Plane                        │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐     │
│  │ App + EP │  │ App + EP │  │ App + EP │     │
│  │ (Pod A)  │  │ (Pod B)  │  │ (Pod C)  │     │
│  └──────────┘  └──────────┘  └──────────┘     │
│  EP = Envoy Proxy (istio-proxy sidecar)        │
└─────────────────────────────────────────────────┘

Kubernetes API Server
        │
        ▼
   ┌─────────┐
   │  Pilot  │ ← Watches Istio CRDs (VirtualService, DestinationRule, Gateway...)
   │         │ ← Watches Kubernetes resources (Service, Endpoints, Pod...)
   └────┬────┘
        │ xDS (gRPC stream)
        ▼
   ┌─────────┐
   │  Envoy  │ ← Receives LDS, RDS, CDS, EDS, SDS
   └─────────┘

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - name: sidecar-injector.istio.io
    namespaceSelector:
      matchLabels:
        istio-injection: enabled
    rules:
      - apiGroups: ['']
        apiVersions: ['v1']
        operations: ['CREATE']
        resources: ['pods']

1. kubectl apply -f deployment.yaml
        │
2. Kubernetes API Server calls the Admission Webhook
        │
3. istiod Sidecar Injector modifies the pod spec
        │
4. Modified pod spec is returned
        │
5. Pod is created with the modified spec

initContainers:
  - name: istio-init
    image: proxyv2
    command:
      - istio-iptables
      - '-p'
      - '15001' # Envoy outbound port
      - '-z'
      - '15006' # Envoy inbound port
      - '-u'
      - '1337' # istio-proxy UID (traffic from this UID is excluded from redirect)
      - '-m'
      - 'REDIRECT'
    securityContext:
      capabilities:
        add: ['NET_ADMIN', 'NET_RAW']

containers:
  - name: istio-proxy
    image: proxyv2
    ports:
      - containerPort: 15090 # Prometheus metrics
      - containerPort: 15021 # Health check
    env:
      - name: ISTIO_META_CLUSTER_ID
        value: 'Kubernetes'
      - name: PILOT_CERT_PROVIDER
        value: 'istiod'

[Inbound Traffic]
External -> Pod IP:Port
  -> iptables PREROUTING
  -> ISTIO_INBOUND chain
  -> REDIRECT to 15006 (Envoy inbound listener)
  -> Envoy processes then forwards to localhost:AppPort

[Outbound Traffic]
App -> External Service IP:Port
  -> iptables OUTPUT
  -> ISTIO_OUTPUT chain
  -> REDIRECT to 15001 (Envoy outbound listener)
  -> Envoy processes then forwards to actual destination

[Exception]
Traffic from UID 1337 (istio-proxy) is excluded from redirect -> prevents infinite loop

[1] User creates a VirtualService
        │
[2] Pilot detects the change via Kubernetes API watch
        │
[3] Pilot translates VirtualService to Envoy RDS configuration
        │
[4] Related CDS and EDS configurations are also generated
        │
[5] Pushed to the workload's Envoy via gRPC stream
        │
[6] Envoy hot-reloads the new configuration (no connection drops)

# Check Envoy listeners for a specific pod
istioctl proxy-config listeners PODNAME.NAMESPACE

# Check route configuration
istioctl proxy-config routes PODNAME.NAMESPACE

# Check cluster configuration
istioctl proxy-config clusters PODNAME.NAMESPACE

# Check endpoints
istioctl proxy-config endpoints PODNAME.NAMESPACE

# Full Envoy configuration dump
istioctl proxy-config all PODNAME.NAMESPACE -o json

[Request Flow]

Listener (port binding)
    │
    ▼
Filter Chain (select matching filter chain)
    │
    ├── Network Filters
    │   ├── TCP Proxy Filter (L4)
    │   └── HTTP Connection Manager (L7)
    │       │
    │       ├── HTTP Filters
    │       │   ├── RBAC Filter (authorization)
    │       │   ├── JWT Authn Filter (authentication)
    │       │   ├── Fault Injection Filter
    │       │   ├── CORS Filter
    │       │   ├── Stats Filter (metrics)
    │       │   └── Router Filter (final routing)
    │       │
    │       └── Route Configuration
    │           ├── Virtual Host selection
    │           └── Route matching and Cluster determination
    │
    ▼
Cluster (upstream selection)
    │
    ▼
Endpoint (actual target pod)

Listener 0.0.0.0:15006 (Inbound)
├── FilterChain: App port (e.g., 8080)
│   ├── TLS Inspector
│   ├── HTTP Connection Manager
│   │   ├── istio_authn filter
│   │   ├── envoy.filters.http.rbac
│   │   └── envoy.filters.http.router
│   └── Route: inbound|8080|http|service.ns.svc.cluster.local
└── FilterChain: Default (passthrough)

Listener 0.0.0.0:15001 (Outbound)
├── FilterChain: Per-service matching
│   ├── HTTP Connection Manager
│   │   ├── envoy.filters.http.fault
│   │   ├── envoy.filters.http.cors
│   │   ├── istio.stats
│   │   └── envoy.filters.http.router
│   └── Route: Per-service VirtualHost
└── FilterChain: PassthroughCluster (unmatched traffic)

spiffe://TRUST_DOMAIN/ns/NAMESPACE/sa/SERVICE_ACCOUNT

Example:
spiffe://cluster.local/ns/production/sa/frontend

[1] istio-agent (in-pod) generates a key pair
        │
[2] Creates a CSR (Certificate Signing Request)
        │
[3] Sends CSR to istiod (gRPC, authenticated via bootstrap token)
        │
[4] istiod validates the CSR:
    - ServiceAccount token validity
    - Namespace membership verification
        │
[5] istiod CA signs the X.509 certificate
        │
[6] Returns signed certificate to istio-agent
        │
[7] istio-agent delivers the certificate to Envoy via SDS
        │
[8] Envoy uses the certificate for mTLS

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-route
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            end-user:
              exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1

{
  "name": "reviews.default.svc.cluster.local:9080",
  "virtual_hosts": [
    {
      "name": "reviews.default.svc.cluster.local:9080",
      "domains": ["reviews.default.svc.cluster.local"],
      "routes": [
        {
          "match": {
            "prefix": "/",
            "headers": [
              {
                "name": "end-user",
                "string_match": {
                  "exact": "jason"
                }
              }
            ]
          },
          "route": {
            "cluster": "outbound|9080|v2|reviews.default.svc.cluster.local"
          }
        },
        {
          "match": {
            "prefix": "/"
          },
          "route": {
            "cluster": "outbound|9080|v1|reviews.default.svc.cluster.local"
          }
        }
      ]
    }
  ]
}

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-destination
spec:
  host: reviews
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100

{
  "name": "outbound|9080|v1|reviews.default.svc.cluster.local",
  "type": "EDS",
  "eds_cluster_config": {
    "service_name": "outbound|9080|v1|reviews.default.svc.cluster.local"
  },
  "circuit_breakers": {
    "thresholds": [
      {
        "max_connections": 100
      }
    ]
  },
  "transport_socket": {
    "name": "envoy.transport_sockets.tls",
    "typed_config": {
      "common_tls_context": {
        "tls_certificate_sds_secret_configs": [
          {
            "name": "default",
            "sds_config": {
              "api_config_source": {
                "api_type": "GRPC",
                "grpc_services": [
                  {
                    "envoy_grpc": {
                      "cluster_name": "sds-grpc"
                    }
                  }
                ]
              }
            }
          }
        ]
      }
    }
  }
}

$ istioctl proxy-status
NAME                    CDS    LDS    EDS    RDS    ECDS   ISTIOD
frontend-v1-xxx.prod    SYNCED SYNCED SYNCED SYNCED        istiod-abc
reviews-v1-yyy.prod     SYNCED SYNCED SYNCED SYNCED        istiod-abc
ratings-v1-zzz.prod     STALE  SYNCED SYNCED SYNCED        istiod-abc

# Compare configuration sent by istiod with proxy's current config
istioctl proxy-config all PODNAME -o json > proxy-config.json
istioctl proxy-status PODNAME --diff

# Optimize Envoy memory with Sidecar resource
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default
  namespace: production
spec:
  egress:
    - hosts:
        - './*' # Same namespace services
        - 'istio-system/*' # Istio system services
        - 'monitoring/prometheus' # Specific external service