Split View: Istio 트래픽 관리 엔진 심층 분석

VirtualService (Istio CRD)
        │
        ▼ Pilot Translation Engine
Envoy Route Configuration
  ├── VirtualHost (host-based matching)
  │   ├── Route (path/header matching)
  │   │   ├── RouteAction (routing target)
  │   │   ├── WeightedCluster (weight-based splitting)
  │   │   └── RetryPolicy (retry policy)
  │   └── Route (default path)
  └── VirtualHost (other hosts)

# Istio VirtualService
spec:
  http:
    - route:
        - destination:
            host: reviews
            subset: v1
          weight: 75
        - destination:
            host: reviews
            subset: v2
          weight: 25

{
  "route": {
    "weighted_clusters": {
      "clusters": [
        {
          "name": "outbound|9080|v1|reviews.default.svc.cluster.local",
          "weight": 75
        },
        {
          "name": "outbound|9080|v2|reviews.default.svc.cluster.local",
          "weight": 25
        }
      ],
      "total_weight": 100
    }
  }
}

DestinationRule
  ├── host → Cluster name prefix
  ├── subsets → Individual Cluster creation
  │   ├── subset v1 → outbound|9080|v1|reviews.default.svc.cluster.local
  │   └── subset v2 → outbound|9080|v2|reviews.default.svc.cluster.local
  └── trafficPolicy → Cluster-level settings
      ├── connectionPool → circuit_breakers
      ├── outlierDetection → outlier_detection
      └── loadBalancer → lb_policy

direction|port|subset|FQDN

Examples:
outbound|9080|v1|reviews.default.svc.cluster.local
inbound|8080||productpage.default.svc.cluster.local

Request 1 → Endpoint A
Request 2 → Endpoint B
Request 3 → Endpoint C
Request 4 → Endpoint A  (cycles back)

Endpoint A: 3 active connections
Endpoint B: 1 active connection  ← next request goes here
Endpoint C: 5 active connections

Randomly selects an endpoint for each request
Statistically even distribution at scale

spec:
  trafficPolicy:
    loadBalancer:
      consistentHashLB:
        httpHeaderName: x-user-id

Hash Ring:
   0 ─── EP_A ─── EP_B ─── EP_C ─── MAX
         │              │
    x-user-id:alice  x-user-id:bob
    (always EP_A)    (always EP_B)

# Istio DestinationRule
spec:
  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50

{
  "outlier_detection": {
    "consecutive_5xx": 5,
    "interval": "10s",
    "base_ejection_time": "30s",
    "max_ejection_percent": 50,
    "enforcing_consecutive_5xx": 100
  }
}

[Closed] ──── consecutive 5xx >= 5 ────→ [Open/Ejected]
   ▲                                          │
   │                                   baseEjectionTime elapsed
   │                                          │
   └──────── successful request ──────── [Half-Open]
                                          (retry)

spec:
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 1024
        http2MaxRequests: 1024
        maxRequestsPerConnection: 10
        maxRetries: 3

Request arrives
    │
    ▼
maxConnections (100) exceeded? ──→ 503 (overflow)
    │ No
    ▼
http1MaxPendingRequests (1024) exceeded? ──→ 503 (overflow)
    │ No
    ▼
http2MaxRequests (1024) exceeded? ──→ 503 (overflow)
    │ No
    ▼
Start processing request
    │
maxRequestsPerConnection (10) reached? ──→ Close connection, create new one

spec:
  http:
    - route:
        - destination:
            host: reviews
      retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: gateway-error,connect-failure,retriable-4xx

{
  "retry_policy": {
    "retry_on": "gateway-error,connect-failure,retriable-4xx",
    "num_retries": 3,
    "per_try_timeout": "2s",
    "retry_host_predicate": [
      {
        "name": "envoy.retry_host_predicates.previous_hosts"
      }
    ]
  }
}

Original request → Endpoint A (fails, 503)
    │
Retry 1 → Endpoint B (fails, 503)  ← avoids A via previous_hosts
    │
Retry 2 → Endpoint C (fails, 503)  ← avoids A, B
    │
Retry 3 → Endpoint A (succeeds, 200)  ← reuses when candidates exhausted
    │
Final response: 200

spec:
  http:
    - fault:
        delay:
          percentage:
            value: 10
          fixedDelay: 5s
      route:
        - destination:
            host: reviews

Request arrives
    │
    ▼
Fault Filter: Generate random number (0-100)
    │
    ├── random <= 10 → delay 5 seconds then pass to next filter
    │
    └── random > 10 → immediately pass to next filter
    │
    ▼
Router Filter → Forward to upstream

spec:
  http:
    - fault:
        abort:
          percentage:
            value: 20
          httpStatus: 503
      route:
        - destination:
            host: reviews

Request arrives
    │
    ▼
Fault Filter: Generate random number (0-100)
    │
    ├── random <= 20 → immediately return 503 (no upstream request)
    │
    └── random > 20 → pass to next filter

spec:
  http:
    - fault:
        delay:
          percentage:
            value: 50
          fixedDelay: 3s
        abort:
          percentage:
            value: 10
          httpStatus: 500

spec:
  http:
    - route:
        - destination:
            host: reviews
            subset: v1
      mirror:
        host: reviews
        subset: v2
      mirrorPercentage:
        value: 100

Request arrives
    │
    ├── Original request → reviews v1 (response returned to client)
    │
    └── Mirror request → reviews v2 (response ignored, fire-and-forget)
         │
         └── "-shadow" suffix added to Host header
             e.g., reviews → reviews-shadow

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
    - api.external-service.com
  location: MESH_EXTERNAL
  ports:
    - number: 443
      name: https
      protocol: TLS
  resolution: DNS

ServiceEntry
    │
    ├── Listener: Filter chain added to 0.0.0.0:443 (outbound)
    │
    ├── Cluster: outbound|443||api.external-service.com
    │   ├── type: STRICT_DNS
    │   └── dns_lookup_family: V4_ONLY
    │
    └── Route: api.external-service.com → routes to that Cluster

spec:
  http:
    - match:
        - headers:
            x-canary:
              exact: 'true'
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1

spec:
  http:
    - match:
        - uri:
            prefix: '/api/v2'
      route:
        - destination:
            host: api-v2
    - match:
        - uri:
            prefix: '/api'
      route:
        - destination:
            host: api-v1

spec:
  http:
    - match:
        - sourceLabels:
            app: frontend
            version: v2
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1

# Check VirtualService application status
istioctl analyze -n NAMESPACE

# Check routing config for a specific service
istioctl proxy-config routes PODNAME -o json | python3 -m json.tool

# Check Envoy cluster statistics
istioctl proxy-config clusters PODNAME --fqdn reviews.default.svc.cluster.local

# Check circuit breaker status (Envoy admin port)
kubectl exec PODNAME -c istio-proxy -- curl -s localhost:15000/clusters | grep outlier

# Retry statistics
kubectl exec PODNAME -c istio-proxy -- curl -s localhost:15000/stats | grep retry