istio-handbook | Istio 服务网格 —— 后 Kubernetes 时代的应用网络 - https | Service Mesh library

Turned out to be version mismatch - my ETCD db is v3.5.2 and the clientv3 library that I used was v3.5.0. As seen in ETCD changelog (https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md):

Finally found it. Nomad has an option to expose a particular endpoint via sidecar proxy without mTLS authentication. The use case of this option is specifically for health check or metrics.

https://www.nomadproject.io/docs/job-specification/expose#expose-examples

The expose stanza inside connect stanza helps to achieve this.

On GKE you'd set up a circuit breaker to prevent overloading your legacy backend systems from a surge in requests.

To accomplish the same on Cloud Run or Cloud Functions, you can set a maximum number of instances. From that documentation:

Specifying maximum instances in Cloud Run allows you to limit the scaling of your service in response to incoming requests, although this maximum setting can be exceeded for a brief period due to circumstances such as traffic spikes. Use this setting as a way to control your costs or to limit the number of connections to a backing service, such as to a database.

First things first: HTTP/1.1 does allow multiple request per connection with Keep-Alive header. This is the default behavior (RFC 2616, Section 8.1).

The documentation is a bit unclear.

maxRequestsPerConnection description states:

Maximum number of requests per connection to a backend. Setting this parameter to 1 disables keep alive. Default 0, meaning “unlimited”, up to 2^29.

Setting maxRequestsPerConnection to 1 disables Keep-Alive. Setting it to any other value (value > 1) switches Keep-Alive back on.

Setting this field to proper value (not too high, not too low) is the hard part of configuring Istio, and is dependent on your application needs and traffic.

So there isn't any kind of integration with Linkerd and SPIFFE/SPIRE. As of right now there isn't any particular plan for an integration but you can see the existing issue for more details. The next release of Linkerd, 2.11, will include the ability to create server side policy but current versions don't enforce any kind of policy settings.

Most probably port number is causing the error and if not, try deleting the mesh policies

Also please validate based on below points:

1.If you recently updated istio try downgrading it. 2.Look again in Sidecar logs for any conflicts or try disabling it. 3.When it comes to curl 56 error packet transmission; limit could be the problem.

An "Ingress" is responsible for Routing Traffic into your Cluster (from the Docs: An API object that manages external access to the services in a cluster, typically HTTP.)

On the other side, a Service-Mesh is a tool that adds proxy-Containers as Sidecars to your Pods and Routs traffic between your Pods through those proxy-Containers.

use-Cases for Service-Meshes are i.E.

• distributed tracing
• secure (SSL) connections between pods
• resilience (service-mesh can reroute traffic from failed requests)
• network-performance-monitoring

You can create an ingress class that references the ingress controller that is deployed by default in the istio-system namespace. This configuration with ingress will work, however to my current knowledge, this is only used for backwards compatibility. If you want to use istio ingress controller functionality, you should use istio gateway and virtual service instead:

Using the Istio Gateway, rather than Ingress, is recommended to make use of the full feature set that Istio offers, such as rich traffic management and security features.

If this solution is not optimal for you, you should use e.g. nginx ingress controller and you can still bind it with annotations (deprecated) or using IngressClass. To my present knowledge it is not possible to bind this ingress class with an additional ingress controller. If you need an explanation, documentation, you should create an issue on github.

Summary: The recommended option is to use the gateway with virtual service. Another possibility is to use nginx alone ingress with different classes and an ingress resource for them.

Apparently, it was a stupid mistake of missing out serviceAccountName in the deployment template spec.