when implementing canary deployment using istio, I want to create secondary(for canary) deployment and svc while modifying the virtualservice’s destination rule traffic. However, if I change the destination rule and create canary svc & deployment at the same time, traffic will go to non-ready canary deployment. In K8s, there is readiness probe but it’s limited to deployment resource. Is there anything in Istio that can send traffic to svc when the deployment itself is ready? If it’s not possible, I might have to add one step, that waits until the deployment is ready..
Can Istio virtualservice know when to pass traffic to svc, only when the deployment is ready?
Viewed 161
1 Answers
With the case of heath checks Istio does not support active health check by its own but instead rely on Kubernetes liveness and readiness probes. However remember that with mutualTLS enabled the https request probe won't work and you'll need special annotation that will make the sidecar agent to pick up the request.
You can read more about it at application health check section.
The principle of canary deployment is to roll out new code/features to a subset of users as an initial test. This means that old deployment still covers most of your traffic with the new deployment run by its side. Traffic shifting should be handled as a separate deployment task. This blog post describes the canary deployments with istio and how traffic can be weighted with virtual service. Readiness probes then will handle the pod start failures excluding any endpoint from the chain that is not ready.
Having any traffic-wise probe would be less beneficial because you would need at least one failed request to trigger the endpoint removal from the load balancing.
Related