dougreid

Resiliency: Centralized proxies can suffer from shared failure domain issues (especially when large number of configs, etc., are deployed).

Performance: Side-loaded proxies tend to perform better, in part because they deal with a subset of config.

Our choice of sidecar deployment was informed by on our (Google, Lyft) experiences with both centralized and sidecar models. However, that being said, Istio is not predicated on per-pod deployment.

Kubernetes supports a microservices architecture through the Service construct and performs rudimentary L4 load balancing and more.

But it doesn’t help with higher-level problems, such as L7 metrics, rate limiting and circuit breaking.

This is where Istio comes in.

Disclaimer: I work on Istio.

Envoy is a big part of the solution, yes. But it isn't the only component. A control plane layer, including an auth component and an adaptable policy enforcement and telemetry collection component, is included as well.

More info is available in the overview doc here: https://istio.io/docs/concepts/what-is-istio/overview.html

The initial release for Istio is targeted at kubernetes. However, Istio is designed to be easy to adapt to other environments. With community help, we anticipate extending it to enable services across cloud foundry, VM, and hybrid clouds. We hope to have major new releases every 3 months, including adding new environments.

That suggestion is based on the requirements of the underlying bookinfo sample application and is not related to Istio itself.

Disclaimer: I work on Istio.

Some thoughts:

Linkerd is great technology but it is restricted to traffic management only. Istio provides a complete mesh that incorporates authentication and policy enforcement, in addition to traffic management and telemetry.

The Istio Auth subsystem provides certificate management and we are working on extending it to support authorization primitives as well.

The telemetry model is also different. Rather than having direct integrations with different metrics backends, we normalize metrics and pipe them through a single engine that can then re-route to any metrics backends (or multiple).

In contrast to Envoy, linkerd provides a minimalist configuration language, and explicitly does not support hot reloads, relying instead on dynamic provisioning and service abstractions.

Disclaimer: I work on Istio (on Mixer).