Istio
What it is
Istio is a free, open-source service mesh for securing, connecting, and monitoring distributed applications with few or no changes to service code. It manages HTTP, gRPC, WebSocket, and TCP traffic with automatic load balancing, routing rules, retries, failovers, and fault injection. Deployment choices include sidecar mode and ambient mode, which uses a per-node Layer 4 proxy and can add a per-namespace Envoy proxy for Layer 7 features. Its control plane runs on Kubernetes, and the mesh can extend to other clusters, virtual machines, and endpoints outside Kubernetes. Security capabilities include workload identity, mutual TLS, authentication, authorization policies, and audit tools. Istio can generate metrics, logs, and traces for cluster traffic, including ingress and egress. It can be installed with istioctl or Helm, and its documented integrations include tools such as Grafana, Jaeger, Kiali, and Prometheus. The Istio 1.31 release supports Kubernetes 1.32 through 1.36. Minor releases have a defined support window; development builds have no support.
For and against
For
- Free and open source
- Supports sidecar and ambient deployment modes
- Offers mutual TLS and authorization policies
- Generates traffic metrics, logs, and traces
Against
- Control plane runs on Kubernetes
- Development builds have no support
- Release support ends six weeks after the N+2 minor release
The verdict
Istio offers traffic controls, security, and observability for distributed workloads, with installation through istioctl or Helm. Teams should account for its Kubernetes control plane and release support window.
Who it suits
Istio suits teams operating distributed applications on Kubernetes that need traffic management, security controls, or observability. Its mesh can also reach virtual machines and endpoints beyond Kubernetes.
Plans and prices
Istio
Open source service mesh · Releases accessible at no cost
Read 29 Sep 2026 · istio.io
On the record
- Community support
- For supported releases, the Istio community provides patch releases for critical issues and technical assistance; partners may offer longer-term support.istio.io · read 29 Sep 2026
- Deployment modes
- Istio supports sidecar mode and ambient mode, which uses a per-node Layer 4 proxy and optionally a per-namespace Envoy proxy for Layer 7 features.istio.io · read 29 Sep 2026
- Extensibility
- Istio uses Envoy proxies and supports extensions including WebAssembly modules and third-party policy systems.istio.io · read 29 Sep 2026
- Installation
- Istio can be installed with istioctl or Helm, and its release archive includes the istioctl binary, installation profiles, Helm charts, and samples.istio.io · read 29 Sep 2026
- Integrations
- Istio’s integration documentation covers cert-manager, Grafana, Jaeger, Kiali, Prometheus, SPIRE, Apache SkyWalking, Zipkin, and third-party load balancers.istio.io · read 29 Sep 2026
- Observability
- Istio can generate metrics, logs, and traces for traffic in a cluster, including ingress and egress traffic.istio.io · read 29 Sep 2026
- Project status
- Istio is a graduated Cloud Native Computing Foundation project.istio.io · read 29 Sep 2026
- Release support window
- A minor release is supported until six weeks after the N+2 minor release, and development builds have no support.istio.io · read 29 Sep 2026
- Security
- Istio security features include workload identity, mutual TLS, authentication, authorization policies, and audit tools.istio.io · read 29 Sep 2026
- Supported Kubernetes versions
- The Istio 1.31 release supports Kubernetes versions 1.32 through 1.36.istio.io · read 29 Sep 2026
- Traffic management
- Istio supports automatic load balancing for HTTP, gRPC, WebSocket, and TCP traffic, plus routing rules, retries, failovers, and fault injection.istio.io · read 29 Sep 2026
- What it does
- Istio is an open source service mesh that adds ways to secure, connect, and monitor distributed applications with few or no service code changes.istio.io · read 29 Sep 2026
- Workload environments
- Istio’s control plane runs on Kubernetes and the mesh can extend to other clusters, virtual machines, and endpoints outside Kubernetes.istio.io · read 29 Sep 2026
