Configuring Mesh-Wide Settings

1. Configuring Mesh Configuration Resource

Property	Description	Values	Notes
meshConfig	Root configuration object for the service mesh	`{}`	Contains all global settings for the mesh
meshConfig.accessLogFormat	Format for access logs	`string`	Defaults to JSON format
meshConfig.defaultConfig	Default configuration for sidecars	`{}`	Applies to all proxies in the mesh
meshConfig.enablePrometheusMerge	Enable merging of Prometheus metrics	`true` \| `false`	Defaults to `true`
meshConfig.tracing	Tracing configuration	`{}`	Supports Zipkin, Jaeger, and other tracing backends

Example: Setting up mesh configuration resource

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-config
data:
  meshConfig: |
    accessLogFormat: "%START_TIME% %REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?)% %RESP(X-ENVOY-ORIGINAL-STATUS)%"
    defaultConfig:
      proxyMetadata:
        PROXY_CONFIG: "value"
    enablePrometheusMerge: true
    tracing:
      zipkin:
        address: "zipkin.istio-system.svc.cluster.local:9411"

Note: The meshConfig resource is typically managed by the control plane and updated via istioctl or Kubernetes API.

2. Setting Default Sidecar Configuration

Property	Values	Description
sidecar.image	`istio/proxyv2:1.21.0`	Default container image for the sidecar proxy
sidecar.resources.requests.cpu	`10m`	Minimum CPU requested by the sidecar
sidecar.resources.requests.memory	`32Mi`	Minimum memory requested by the sidecar
sidecar.resources.limits.cpu	`2`	Maximum CPU allowed for the sidecar
sidecar.resources.limits.memory	`128Mi`	Maximum memory allowed for the sidecar
sidecar.traffic.includeInboundPorts	`[80, 443]`	Ports to include in inbound traffic interception
sidecar.traffic.excludeInboundPorts	`[15000, 15001]`	Ports to exclude from inbound traffic interception
sidecar.traffic.includeOutboundPorts	`[]`	Ports to include in outbound traffic interception
sidecar.traffic.excludeOutboundPorts	`[15000, 15001]`	Ports to exclude from outbound traffic interception
sidecar.traffic.outboundTrafficPolicy.mode	`ALLOW_ANY`	Mode for outbound traffic policy (ALLOW_ANY or REGISTRY_ONLY)

Example: Default Sidecar Configuration in Istio

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-config
data:
  sidecar.image: "istio/proxyv2:1.21.0"
  sidecar.resources.requests.cpu: "10m"
  sidecar.resources.requests.memory: "32Mi"
  sidecar.resources.limits.cpu: "2"
  sidecar.resources.limits.memory: "128Mi"
  sidecar.traffic.includeInboundPorts: "[80, 443]"
  sidecar.traffic.excludeInboundPorts: "[15000, 15001]"
  sidecar.traffic.includeOutboundPorts: "[]"
  sidecar.traffic.excludeOutboundPorts: "[15000, 15001]"
  sidecar.traffic.outboundTrafficPolicy.mode: "ALLOW_ANY"

3. Configuring Outbound Traffic Policy

Policy	Description	Default	Notes
outboundTrafficPolicy.mode	Controls how outbound traffic is handled	`ALLOW_ANY`	Can be `ALLOW_ANY`, `DENY_ALL`, or `REGISTRY_ONLY`
outboundTrafficPolicy.exceptions	Services to exclude from traffic policy enforcement	`[]`	Array of service names to exempt

Example: Configure Outbound Traffic Policy

apiVersion: networking.istio.io/v1beta1
kind: MeshConfig
metadata:
  name: istio
spec:
  outboundTrafficPolicy:
    mode: ALLOW_ANY
    exceptions:
      - name: "external-service"
        namespace: "default"

Note: ALLOW_ANY allows all outbound traffic, while DENY_ALL blocks all traffic except explicitly allowed.

Warning: Setting outboundTrafficPolicy.mode to DENY_ALL can break applications that rely on external services.

4. Setting Proxy Resource Defaults

Property	Values	Description
proxy.resources.requests.cpu	`100m`	CPU request for proxy containers
proxy.resources.requests.memory	`128Mi`	Memory request for proxy containers
proxy.resources.limits.cpu	`200m`	CPU limit for proxy containers
proxy.resources.limits.memory	`256Mi`	Memory limit for proxy containers

Example: Setting Proxy Resource Defaults in Helm Values

proxy:
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 200m
      memory: 256Mi

5. Configuring Default Tracing Settings

Setting	Description	Default Value	Notes
tracing.enabled	Enables or disables tracing for all services in the mesh	`false`	Set to `true` to enable tracing across the mesh
tracing.backend	Specifies the tracing backend to use (e.g., Jaeger, Zipkin)	`jaeger`	Supported values: `jaeger`, `zipkin`
tracing.sampleRate	Percentage of requests to trace (0.0 to 1.0)	`0.1`	Set to `1.0` for 100% tracing
tracing.serviceName	Name of the service in the tracing backend	`service-mesh`	Used to identify the service in trace UIs

Example: Enabling Tracing with Jaeger

tracing:
  enabled: true
  backend: jaeger
  sampleRate: 0.5
  serviceName: "my-mesh-service"

Note: Tracing settings can be overridden per service using tracing in the service-specific configuration.

6. Setting Mesh-Wide mTLS Mode

Mode	Description	Configuration	Notes
disabled	Disables mTLS for all traffic in the mesh	`mtls: disabled`	Use only for testing or non-production environments
permissive	Allows both mTLS and plaintext traffic	`mtls: permissive`	Use for gradual migration or mixed protocol environments
strict	Enforces mTLS for all traffic in the mesh	`mtls: strict`	Recommended for production environments with full mTLS support

Example: Setting mTLS Mode in Istio

apiVersion: security.istio.io/v1
kind: MeshConfig
metadata:
  name: default
spec:
  meshConfig:
    mtls:
      mode: strict

Note: The mtls.mode setting applies to all services in the mesh unless overridden by a PeerAuthentication policy.

7. Configuring Access Logging Defaults

Setting	Description	Default Value	Notes
accessLog.format	Format of the access log entries	`json`	Supported formats: `json`, `text`
accessLog.path	Path to the access log file	`/dev/stdout`	Can be set to a file path or `/dev/stdout`
accessLog.flushInterval	Interval to flush logs to disk	`5s`	Time duration in seconds or milliseconds
accessLog.maxBufferedEntries	Maximum number of entries to buffer before flushing	`1000`	Used to optimize I/O performance

Example: Setting up Access Logging

accessLog:
  format: json
  path: /var/log/access.log
  flushInterval: 10s
  maxBufferedEntries: 500

Note: The access log configuration can be applied at the mesh-wide level or overridden per service.

8. Setting Default Retry Policies

Policy	Description	Configuration	Notes
retryAttempts	Number of retry attempts for failed requests	`3`	Default retry count for mesh-wide operations
retryBackoff	Backoff strategy for retries	`exponential`	Exponential backoff with jitter
retryOn	HTTP status codes to retry on	`5xx, 429`	Retry on server errors and rate limiting
retryTimeout	Maximum time to retry before giving up	`30s`	Global timeout for retry operations

Example: Default Retry Policy Configuration

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default-retry-policy
spec:
  host: "*"
  trafficPolicy:
    retryPolicy:
      attempts: 3
      perTryTimeout: 2s
      retryOn: "5xx,429"

9. Configuring Discovery Selectors

Selector	Description	Example
service.name	Matches services by name	`service.name: "frontend"`
service.namespace	Matches services by namespace	`service.namespace: "prod"`
service.version	Matches services by version label	`service.version: "v2"`
service.label	Matches services by custom label	`service.label: "environment=production"`

Example: Discovery Selector Configuration

discovery:
  selectors:
    - match:
        service.name: "frontend"
        service.namespace: "prod"
      action: "include"
    - match:
        service.label: "environment=staging"
      action: "exclude"

10. Managing Mesh Extension Providers

Provider	Type	Description	Configuration
prometheus	`metrics`	Exposes metrics for Prometheus scraping	`{ "address": "0.0.0.0:9090", "path": "/metrics" }`
jaeger	`tracing`	Collects and exports trace data to Jaeger	`{ "endpoint": "http://jaeger-collector:14268/api/traces", "service": "mesh-tracing" }`
otel-collector	`metrics`, `tracing`	OpenTelemetry collector for observability	`{ "endpoint": "otel-collector:4317", "service": "mesh-otel" }`

Example: Configuring Prometheus Provider

apiVersion: v1
kind: Service
metadata:
  name: prometheus-metrics
spec:
  selector:
    app: mesh-prometheus
  ports:
  - port: 9090
    targetPort: 9090

Example: Configuring Jaeger Tracing

apiVersion: v1
kind: ConfigMap
metadata:
  name: jaeger-config
data:
  collector.endpoint: "http://jaeger-collector:14268/api/traces"

11. Setting Default Timeout Policies

Policy	Default Value	Description
connectTimeout	`10s`	Timeout for establishing connections to the service
requestTimeout	`15s`	Timeout for the entire request including retries
idleTimeout	`60s`	Timeout for idle connections before closing

Example: Default Timeout Configuration

timeout:
  connectTimeout: 10s
  requestTimeout: 15s
  idleTimeout: 60s

12. Configuring Mesh Metadata

Field	Description	Example Value	Notes
meshConfig.metadata.name	Unique identifier for the mesh instance	`"istio-mesh"`	Used for labeling and monitoring
meshConfig.metadata.version	Version of the mesh configuration	`"1.20.0"`	Must match the control plane version
meshConfig.metadata.annotations	Arbitrary key-value pairs for metadata	`{"environment": "production", "team": "backend"}`	Used for filtering and observability

Example: Setting Mesh Metadata

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-mesh
spec:
  meshConfig:
    metadata:
      name: "istio-mesh"
      version: "1.20.0"
      annotations:
        environment: "production"
        team: "backend"