service migration, we need to: ○ Write the ClusterIP service equivalent ○ Make sure Istio-enabled callers update their config with the ClusterIP service ○ Keep a double standard during migration Compounding sustainable approach: ● Use your CD tooling (i.e. Spinnaker) to automate this migration ● Ask users to use the migration pipeline when onboarding with Istio This approach is quite similar to canary release Adopting Istio ● Headless services are erratic with Istio, use ClusterIP services instead, plan the migration wisely ● Use automation pipelines to label Deployments for traffic shifting ● Istio has a risky

gRPC since 2016 ● GoPay had services running on VM and decided to using Envoy XDS and Consul for migration & load balancing the traffic across container and VM. ● Over time, managing Envoy and Consul became

on having ECC be supported in meshConfig for Istio 1.10 as an Alpha feature ○ There will be a migration path and environmental variables as used in this talk will continue to be supported through at

architectural changes ● SPIFFE only certificates ● Configuring workload certificate TTLs ● RSA to ECC migration ● Missing www-authenticate header ● Tuning per-workload proxy concurrency ● Consuming Istio generated

API Tests Low Effort API Testing for Microservices | CONFIDENTIAL • What has changed? – Migration to microservices triggering need for extensive API tests • Problem: – Creating API tests is effort