3 ms·

I recently started investigating Istio, and though it will probably be an unpopular opinion here on HN, I honestly don't understand why it's not a core part of

I recently started investigating Istio, and though it will probably be an unpopular opinion here on HN, I honestly don't understand why it's not a core part of Kubernetes. It's amazingly simple to configure, the docs are pretty OK, and the benefits seems huge. Mutual TLS within minutes? BAM, done. Don't worry about cert rotation, Citatel does that for you. Block all egress, and whitelist what you need? Like, that's a killer feature! Also, the inability to do 90-10 canary releases with plain K8s baffles me. With Istio? Simple... I don't know, I'm sure I'll find the pains of Istio in the coming months, but in my dev cluster, it looks amazing.

tmpz22 7y ago
I have a hunch various cloud providers have been aware of TLS related frustrations for some time and are working on proprietary turn key products to add to their own offerings at relatively high prices. This quietly disincentivized them to lean into any OSS stacks that will take away from this future revenue stream.
briffle 7y ago
its only recently become 'stable' but google offers it now in GKE baked into their clusters, if you want.
williamallthing 7y ago
Have you given Linkerd a try for comparison? Mutual TLS in 0 seconds (it's on by default) and a significantly lighter footprint. Canary traffic via SMI. Etc