Service mesh concept overview in Kubernetes - Commands & Configuration

Introduction

When you run many small services that need to talk to each other, it can get hard to manage how they connect, secure their communication, and watch their traffic. A service mesh helps by adding a layer that handles these tasks automatically, so your services can focus on their work without worrying about networking details.

When you have multiple microservices that need secure and reliable communication.

When you want to monitor and control traffic between services without changing their code.

When you need automatic retries, load balancing, or circuit breaking between services.

When you want to enforce security policies like encryption and authentication between services.

When you want to collect detailed metrics and logs about service-to-service communication.

Commands

Create a separate namespace to install the service mesh components safely isolated from your app workloads.

Terminal

kubectl create namespace istio-system

Expected Output

namespace/istio-system created

Install the minimal Istio operator which manages the service mesh installation and lifecycle.

Terminal

kubectl apply -f https://github.com/istio/istio/releases/download/1.18.0/istio-minimal-operator.yaml -n istio-system

Expected Output

customresourcedefinition.apiextensions.k8s.io/istiooperators.install.istio.io created

customresourcedefinition.apiextensions.k8s.io/istiooperatorconfigs.install.istio.io created

serviceaccount/istio-operator created

clusterrole.rbac.authorization.k8s.io/istio-operator created

clusterrolebinding.rbac.authorization.k8s.io/istio-operator created

deployment.apps/istio-operator created

Apply a simple IstioOperator custom resource to install the minimal service mesh control plane in the cluster.

Terminal

kubectl apply -f - <<EOF
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: example-istiocontrolplane
spec:
  profile: minimal
EOF

Expected Output

istiocontrolplane.install.istio.io/example-istiocontrolplane created

Check that the service mesh control plane pods are running and ready.

Terminal

kubectl get pods -n istio-system

Expected Output

NAME                                   READY   STATUS    RESTARTS   AGE

istio-operator-7d9f9f9f9f-abcde       1/1     Running   0          1m

istiod-6f7d8f9f9f-xyz12                1/1     Running   0          30s

Key Concept

If you remember nothing else from this pattern, remember: a service mesh transparently manages how your services connect, secure, and observe each other without changing their code.

Common Mistakes

Trying to install the service mesh components in the default namespace.

This can cause conflicts with existing workloads and makes management harder.

Always create and use a dedicated namespace like 'istio-system' for service mesh components.

Not verifying that the control plane pods are running after installation.

If the control plane is not running, the service mesh features won't work and troubleshooting becomes difficult.

Run 'kubectl get pods -n istio-system' to confirm all pods are ready before proceeding.

Applying incomplete or incorrect IstioOperator configuration files.

This can cause installation failures or partial setups that don't provide full service mesh functionality.

Use official minimal or default profiles from Istio documentation and validate YAML syntax before applying.

Summary

Create a dedicated namespace for service mesh components to keep them isolated.

Install the service mesh control plane using official operator manifests and configuration.

Verify the control plane pods are running to ensure the mesh is ready for use.