Mirroring
This task demonstrates the traffic mirroring capabilities of Istio.
Traffic mirroring, also called shadowing, is a powerful concept that allows feature teams to bring changes to production with as little risk as possible. Mirroring sends a copy of live traffic to a mirrored service. The mirrored traffic happens out of band of the critical request path for the primary service.
In this task, you will first force all traffic to v1
of a test service. Then,
you will apply a rule to mirror a portion of traffic to v2
.
Before you begin
Set up Istio by following the instructions in the Installation guide8.
Start by deploying two versions of the httpbin9 service that have access logging enabled:
httpbin-v1:
httpbin-v2:
httpbin Kubernetes service:
Start the
sleep
service so you can usecurl
to provide load:sleep service:
Creating a default routing policy
By default Kubernetes load balances across both versions of the httpbin
service.
In this step, you will change that behavior so that all traffic goes to v1
.
- Create a default route rule to route all traffic to
v1
of the service:
Now, with all traffic directed to
httpbin:v1
, send a request to the service:Check the logs for
v1
andv2
of thehttpbin
pods. You should see access log entries forv1
and none forv2
:
Mirroring traffic to v2
- Change the route rule to mirror traffic to v2:
This route rule sends 100% of the traffic to v1
. The last stanza specifies
that you want to mirror (i.e., also send) 100% of the same traffic to the
httpbin:v2
service. When traffic gets mirrored,
the requests are sent to the mirrored service with their Host/Authority headers
appended with -shadow
. For example, cluster-1
becomes cluster-1-shadow
.
Also, it is important to note that these requests are mirrored as “fire and forget”, which means that the responses are discarded.
You can use the value
field under the mirrorPercentage
field to mirror a fraction of the traffic,
instead of mirroring all requests. If this field is absent, all traffic will be mirrored.
This route rule sends 100% of the traffic to v1
. The RequestMirror
filter
specifies that you want to mirror (i.e., also send) 100% of the same traffic to the
httpbin:v2
service. When traffic gets mirrored,
the requests are sent to the mirrored service with their Host/Authority headers
appended with -shadow
. For example, cluster-1
becomes cluster-1-shadow
.
Also, it is important to note that these requests are mirrored as “fire and forget”, which means that the responses are discarded.
Send in traffic:
Now, you should see access logging for both
v1
andv2
. The access logs created inv2
are the mirrored requests that are actually going tov1
.
Cleaning up
- Remove the rules:
Shutdown the httpbin9 service and client: