Dealing with TLS certificates and DNS is a little bit of an annoyance, but that's not inherent to Istio. It's just our architecture dictates that traffic comes

Dealing with TLS certificates and DNS is a little bit of an annoyance, but that's not inherent to Istio. It's just our architecture dictates that traffic comes in through either an Azure App Gateway or another channel using IBM API Connect. In the former case, you wind up needing two sets of certificates and DNS names, and in the latter case getting all the certificates set up correctly for mTLS between Istio and APIC is a little bit of a pain. Nothing too crazy, but it enough of an annoyance to note. Dealing with version upgrades is also something that causes some pain. Istio has a moderately fast release cadence and tracking that and matching Istio versions to the underlying version of K8S on AKS makes for a bit of tedium. That said, we've been using Istio on AKS for about three years now and for the most part it "just works". Istio itself mostly just hums silently along doing what it does. The pain has usually been more to do with a combination of 3rd party software (like our system for generating and managing the aforementioned TLS certs), corporate policy, and things that are just artifacts of running on Azure and specifics of our architecture.