As the mesh between your services, Istio improves visibility into your application. This improves your ability to debug your application, but how do you debug Istio? This talk will get you up to speed with how Istio (Pilot) and Envoy interact followed by a live debugging session.

1. Debugging Istio Networking
Liam White

2. Liam White
@liamandrewwhite

3. @liamandrewwhite

4. @liamandrewwhite

5. @liamandrewwhite
Tools?
istioctl proxy-status
istioctl proxy-config
kubectl
stern (kube logs)

7. @liamandrewwhite
Backend
Frontend

8. @liamandrewwhite
Static vs Dynamic config

9. @liamandrewwhite
Frontend NetworkPolicyBackend NetworkPolicy
PILOT PILOTPILOT
APP APP APPAPPAPP

10. @liamandrewwhite
istioctl proxy-status
PROXY CDS LDS EDS RDS
details-v1-6dcc6fbb9d-wsjz4.default SYNCED SYNCED SYNCED (100%) SYNCED
istio-ingressgateway-7d6874b48f-qxhn5.istio-system STALE SYNCED SYNCED (100%) NOT SENT
productpage-v1-6c886ff494-hm7zk.default SYNCED SYNCED SYNCED (100%) STALE
ratings-v1-5d9ff497bb-gslng.default STALE SYNCED STALE SYNCED
reviews-v1-55d4c455db-zjj2m.default STALE SYNCED SYNCED (100%) SYNCED
reviews-v2-686bbb668-99j76.default SYNCED SYNCED SYNCED (100%) SYNCED
reviews-v3-7b9b5fdfd6-4r52s.default SYNCED STALE SYNCED (100%) SYNCED

12. @liamandrewwhite
/productpage
/login
GET /login
¯_(ツ)_/¯

13. @liamandrewwhite
APP
:15001
0.0.0.0:9080 (Listener)
9080 (Route)
Host? reviews.default.svc.cluster...
Prefix? /book
User-Agent? Android
outbound|9080|v2|reviews (Cluster)
10.0.2.9:9080
(Endpoint)
10.1.2.1:9080
GET /book/1 HTTP/1.1
Host: reviews...
User-Agent: Android
REDIRECT
10.0.2.5:9080
(Endpoint)
10.0.2.9:9080
app: reviews
version: v2
10.1.2.1:9080
app: reviews
version: v1
10.0.2.5:9080
app: reviews
version: v2

14. @liamandrewwhite
0.0.0.0:9080 (Listener)
9080 (Route)
Host? reviews.default.svc.cluster...
Prefix? /
User-Agent? Android
outbound|9080|v2|reviews (Cluster)
10.0.2.9:9080
(Endpoint)
10.0.2.5:9080
(Endpoint)
Virtual Service
Defines a set of traffic routing rules
to apply when a host is addressed
(e.g. redirects, retries, rewrites,
timeouts, header manipulation,
fault injection and mirroring).
Destination Rule
Defines policies that apply to
traffic intended for a service after
routing has occurred (e.g. load
balancing policy, outlier detection,
tls and connection pool settings). 10.0.2.9:9080

15. @liamandrewwhite
/productpage
/login

17. Questions?
@liamandrewwhite
Slides & Demo