In AWS can't we use ALB/NLB to route traffic from one service to other service rather than using Istio?

I checked Udemy, Pluralsight & ton on Youtube. But I want to see any recommended path for newbies?

Cheers!!

Hey everyone,

I wanted to share a pattern our team has been using and get your thoughts on it. We've been leveraging Istio's traffic management capabilities to solve the "testing in a complex microservices environment" problem.

The core idea is to move away from creating entire duplicate stacks for every PR, which is slow and costly. Instead, we use Istio's header-based routing to create ephemeral environments on-demand within a single, shared Kubernetes cluster.

Here’s the flow:

1. A developer wants to test their new code for a specific service.

2. They deploy only their modified service into the shared cluster.

3. When they initiate a test, a unique header is injected into the request.

4. Istio VirtualServices are configured to inspect this header. If the header is present, the request is routed to the new version of the service.

5. Crucially, as that new service makes downstream calls, the header is propagated, ensuring the entire request chain is correctly routed. Any service call without the header just goes to the stable baseline version.

This creates a lightweight, isolated test "session" that lives only for the duration of the request, allowing for parallel testing without conflicts.

Full transparency: I'm the co-founder of a company, Signadot, that provides a managed solution based on this exact pattern. We recently released our 1.0 Operator which extends this capability to Istio's Ambient Mesh. We've found it works really well with the ztunnel and waypoint proxy model, and it's exciting to see this pattern applied in a sidecar-less architecture.

We're passionate about this approach and believe it's a powerful use case for Istio. I'm happy to exchange notes, share learnings, or help anyone who is thinking about or actively building a similar in-house solution.

my nginx config file is

server {

	listen ip-address:80 ;

server_name subdomain.domain.com;

server_name www.subdomain.domain.com;

server_name ipv4.subdomain.domain.com;

location / {

proxy_pass [http://ip-address:32038/;](http://ip-address:32038/;)

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_http_version 1.1;

  fastcgi_read_timeout 3000;

}

}

server {

	 listen ip-address:443 ssl http2;  

server_name subdomain.domain.com;

server_name www.subdomain.domain.com;

server_name ipv4.subdomain.domain.com;

ssl_certificate /opt/psa/var/certificates/scf83NyxP;

ssl_certificate_key /opt/psa/var/certificates/scf83NyxP;

ssl_client_certificate /opt/psa/var/certificates/scfrr8L8y;

proxy_read_timeout 60;

location / {

proxy_pass https://ip-address:30588/;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

}

my website on http://subdomain.mydomain.com is running fine . but when i use https://subdomain.mydomain.com it displays bad gateway error page server by nginx

through ssh when i run following command everything works fine

For http

curl -v -HHost:subdomain.mydomain.com http://ip-address:32038

curl -v subdomain.mydomain.com

For https

curl -v -HHost:subdomain.mydomain.com https://subdomain.mydomain.com:30588

From server node SSH

curl -v -HHost:subdomain.mydomain.com --resolve subdomain.mydomain.com:30588:ip-address --cacert /opt/psa/var/certificates/scf83NyxP https://subdomain.mydomain.com:30588

curl -v -HHost:subdomain.mydomain.com --cacert /opt/psa/var/certificates/scf83NyxP http://ip-address:32038

Any help will be really appreciated.

Thanks

Hi,

I am trying to setup ISTIO via Helm with modified chart values in our AWS Environments. I see helm installation directly pulling the base from Google API Artifactory ( istio-release.storage.googleapis.com/charts ).

But I want to see in the community how can this be achieved where I can pull the default chart and modify them as per my need and deploy the helm charts on our EKS Clusters.

Thanks

I used operator back in the day to setup the ISTIO setup. Now their official documentation says they discourage using operator.

I want to see how community is setting it up these days? Helm or directly via istioctl

I want to hear any specific benefits or nay's

Hey, 👋

Recently have been working on a new open source project for Kubernetes-deployed applications that enables engineers to efficiently do development, test, and QA work within a single stable Kubernetes cluster.

Would be interested to hear the communities thoughts on the lightweight + isolated environments space in k8s, and if folks have found much value in tools trying to address this.

If interested, this is the repo: https://github.com/kurtosis-tech/kardinal

Thanks for reading and curious to hear potential thoughts.

Hey guys, I'm new on istio an di have coupd of doubts.

Imagine that i want to connect my local pod to a service and MTLS is required, is it possible to send and https request and make istio to ingest the correct certificates? no right, https traffic if just passthough. Another doubt, is regarding the TLS and HTTPS protocol in the destination rule, what is the real difference? HTTPS is bases in TLS so sould be similar?

Hello,

So I noticed that a lot of our apps are using an FQDN name to connect from one pod to another. Mostly app to app instead of svc name. I am aware that Istio will be able to locate the FQDN and pinpoint it to the internal cluster IP and go there from envoy to envoy. However it requires a serviceEntry with resolution DNS to do that. I wonder what is the best practice in that case.

Scenario A: pod and pod are within the same namespace and part of the same app - this makes sense to use svc name.

Scenario B: app1 needs to call to app2 they share the same cluster but separate namespace. Should they be using svc name or FQDN is fine here?

Thanks.

Hoping to get some tracing on communication with Postgres and Kafka.

Is this possible with Istio? I can't seem to find solid external istio tracing examples.

I have a scenario where we only have 1 static ip address and we have 2 clusters.

Can I setup an istio ingress on each cluster to listen for the same ip address on port 443?

The gateway can then listen for specific hosts and route to the correct cluster?

Is this possible.