Skip to main content

Using with Istio

Running Speedscale in a cluster with Istio installed requires a few extra steps

The Istio Service Mesh modifies a cluster and manages traffic routing. Istio is supported by Speedscale but requires a few extra steps. When running alongside Istio, the Speedscale sidecar adds an additional component called an Envoy Filter. Running as an Envoy Filter has a number of advantages including lower overhead and configurability through Envoy.

Configuration Sidecar for Recording

1. Set sidecar captureMode=istio

On your Kubernetes workload, add the following annotations

sidecar.speedscale.com/inject: true
sidecar.speedscale.com/capture-mode: "istio"

along with any other sidecar annotations.

This will let the Speedscale operator know to patch the sidecar including a WebAssembly Envoy filter.

2. Add speedscale sidecar egress

If the istio sidecar has a custom configuration, ensure that the speedscale namespace is on the egress list. This step is not necessary if you do not have a custom sidecar configuration. Here is an example from the Istio docs:

apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
name: default
namespace: prod-us1
spec:
egress:
- hosts:
- "speedscale/*"

3. Ensure VirtualService contains host

If your service is accessible both outside and inside the cluster, make sure the Istio VirtualService contains the same host. Take a look at the Istio documentation for more information.

Istio allows for numerous different networking configuration options. Please take a look at the Istio documentation or reach out to Speedscale directly for more information.