Istio Traffic Management

From the author

Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.

— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured reference for implementing Istio traffic management in production environments. It covers the core resources required to control traffic flow, including VirtualServices, DestinationRules, Gateways, and ServiceEntries. The guide includes practical templates for common patterns such as canary deployments, circuit breaking, traffic mirroring, and fault injection, alongside best practices for service mesh operations and debugging commands.

What it does

Configures service-to-service routing and load balancing policies.
Implements resilience patterns like circuit breakers, retries, and timeouts.
Facilitates progressive delivery through canary deployment templates.
Defines ingress and egress traffic management via Gateway resources.
Enables traffic mirroring and fault injection for testing and chaos engineering.
Provides debugging commands to analyze and inspect proxy configurations.

When to use it

When implementing advanced traffic routing in a Kubernetes-based service mesh.
When you need to perform canary or blue-green deployments.
When configuring resilience mechanisms to prevent cascading failures.
When setting up ingress gateways for external service access.
When debugging traffic flow or endpoint discovery issues within the mesh.

Advantages

Provides ready-to-use YAML templates for complex traffic scenarios.
Clearly maps Istio resources to their specific operational purposes.
Includes essential best practices to avoid common service mesh pitfalls.
Offers a clear path for incremental configuration of traffic policies.

Usage examples

“How do I configure a canary deployment for my service using Istio?”: The agent provides a VirtualService template with weighted routing and a corresponding DestinationRule to manage traffic distribution between stable and canary subsets.
“Show me how to implement a circuit breaker for a service.”: The agent provides a DestinationRule configuration using outlierDetection and connectionPool settings to manage service health and prevent overload.
“How can I mirror traffic to a new version of my service?”: The agent provides a VirtualService template demonstrating the use of the mirror field to duplicate traffic to a secondary service version.
“What command can I use to debug my Istio route configuration?”: The agent suggests using istioctl analyze to check configuration validity and istioctl proxy-config routes to inspect effective routing rules.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/wshobson/istio-traffic-management/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip istio-traffic-management.zip -d .agents/skills

Documentation by Seth Hobson

Comprehensive guide to Istio traffic management for production service mesh deployments.

When to Use This Skill

Configuring service-to-service routing
Implementing canary or blue-green deployments
Setting up circuit breakers and retries
Load balancing configuration
Traffic mirroring for testing
Fault injection for chaos engineering

Core Concepts

1. Traffic Management Resources

Resource	Purpose	Scope
VirtualService	Route traffic to destinations	Host-based
DestinationRule	Define policies after routing	Service-based
Gateway	Configure ingress/egress	Cluster edge
ServiceEntry	Add external services	Mesh-wide

2. Traffic Flow

Client → Gateway → VirtualService → DestinationRule → Service
                   (routing)        (policies)        (pods)

Templates

Template 1: Basic Routing

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-route
  namespace: bookinfo
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            end-user:
              exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-destination
  namespace: bookinfo
spec:
  host: reviews
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
    - name: v3
      labels:
        version: v3

Template 2: Canary Deployment

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service-canary
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: stable
          weight: 90
        - destination:
            host: my-service
            subset: canary
          weight: 10
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-service-dr
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
  subsets:
    - name: stable
      labels:
        version: stable
    - name: canary
      labels:
        version: canary

Template 3: Circuit Breaker

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: circuit-breaker
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
        maxRetries: 3
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30

Template 4: Retry and Timeout

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ratings-retry
spec:
  hosts:
    - ratings
  http:
    - route:
        - destination:
            host: ratings
      timeout: 10s
      retries:
        attempts: 3
        perTryTimeout: 3s
        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503
        retryRemoteLocalities: true

Template 5: Traffic Mirroring

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: mirror-traffic
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: v1
      mirror:
        host: my-service
        subset: v2
      mirrorPercentage:
        value: 100.0

Template 6: Fault Injection

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: fault-injection
spec:
  hosts:
    - ratings
  http:
    - fault:
        delay:
          percentage:
            value: 10
          fixedDelay: 5s
        abort:
          percentage:
            value: 5
          httpStatus: 503
      route:
        - destination:
            host: ratings

Template 7: Ingress Gateway

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: my-tls-secret
      hosts:
        - "*.example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-vs
spec:
  hosts:
    - "api.example.com"
  gateways:
    - my-gateway
  http:
    - match:
        - uri:
            prefix: /api/v1
      route:
        - destination:
            host: api-service
            port:
              number: 8080

Load Balancing Strategies

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: load-balancing
spec:
  host: my-service
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH
---
# Consistent hashing for sticky sessions
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: sticky-sessions
spec:
  host: my-service
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpHeaderName: x-user-id
        # or: httpCookie, useSourceIp, httpQueryParameterName

Best Practices

Do's

Start simple - Add complexity incrementally
Use subsets - Version your services clearly
Set timeouts - Always configure reasonable timeouts
Enable retries - But with backoff and limits
Monitor - Use Kiali and Jaeger for visibility

Don'ts

Don't over-retry - Can cause cascading failures
Don't ignore outlier detection - Enable circuit breakers
Don't mirror to production - Mirror to test environments
Don't skip canary - Test with small traffic percentage first

Debugging Commands

# Check VirtualService configuration
istioctl analyze

# View effective routes
istioctl proxy-config routes deploy/my-app -o json

# Check endpoint discovery
istioctl proxy-config endpoints deploy/my-app

# Debug traffic
istioctl proxy-config log deploy/my-app --level debug

Files

ATTRIBUTION.mdAdded by AutoGineer1012 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md6.7 KiB

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

K8s Manifest Generator
Seth Hobson· Community
A structured guide for generating secure, production-ready Kubernetes manifests including Deployments, Services, ConfigMaps, and Secrets.
Cloud and DevOpsClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Cloud Infrastructure Kubernetes Architect
Seth Hobson· Community
An expert Kubernetes architect specializing in cloud-native infrastructure, GitOps workflows, and container orchestration.
Cloud and DevOpsClaude Code
MITGitHub stars of the source repository42.3k
Service Mesh Expert
Seth Hobson· Community
An expert architect for designing, securing, and managing service mesh deployments in cloud-native environments.
Cloud and DevOpsClaude Code
MITGitHub stars of the source repository42.3k
Kubernetes Operations Kubernetes Architect
Seth Hobson· Community
An expert Kubernetes architect providing guidance on cloud-native infrastructure, GitOps workflows, and container orchestration.
Cloud and DevOpsClaude Code
MITGitHub stars of the source repository42.3k
Cicd Automation Kubernetes Architect
Seth Hobson· Community
An expert Kubernetes architect providing guidance on cloud-native infrastructure, GitOps workflows, and container orchestration.
Cloud and DevOpsClaude Code
MITGitHub stars of the source repository42.3k
Kubestellar Console
GitHubOfficial
An AI-powered expert for managing multi-cluster Kubernetes environments using the KubeStellar Console.
Cloud and DevOpsGitHub Copilot
MITGitHub stars of the source repository40.9k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download istio-traffic-management.zip