istio

Best Practices

• Use STRICT mTLS via PeerAuthentication for all production namespaces
• Configure retries with retryOn conditions and perTryTimeout in VirtualService
• Set connection pool limits in DestinationRule to prevent cascading failures
• Enable outlier detection for automatic circuit breaking on unhealthy endpoints
• Use AuthorizationPolicy to enforce zero-trust networking between services
• Prefer VirtualService weight-based routing for canary deployments
• Configure request timeouts at the VirtualService level to prevent hung connections
• Use ServiceEntry to control egress traffic to external services
• Apply Sidecar resources to limit proxy memory by restricting egress hosts
• Always specify exportTo to control cross-namespace visibility of configs
• Use consistent labeling (app, version) for traffic routing and telemetry
• Avoid EnvoyFilter unless VirtualService/DestinationRule cannot achieve the goal

Documentation Sources