Fig 2Istio ingress↑↓ v2 weight · click a pod to break itv1 80% · v2 20%
A request: ringed = TLS from the client, dashed ring = mTLS inside the mesh, bare = plain HTTPGateway: istio-ingressgateway Envoy with its TLS port and Secret cartridgeVirtualService turntable splits by weight; diamonds are end-user: jason, always v2xDS cable: istiod pushes config to the gatewayA client's request arrives sealed with TLS at the istio-ingressgateway, an Envoy proxy. The Gateway resource opens port 443 for bookinfo.io and unseals the request with the certificate in its Secret. The VirtualService bound to that Gateway then routes it on the deck: requests with the header end-user: jason always go to v2, the rest split by weight. The DestinationRule defines the v1 and v2 subsets by pod label, sets mutual TLS for the hop to each pod's Envoy sidecar, and turns on outlier detection: a pod that returns errors twice is ejected from the pool for a while and its lamp goes out. Turning the weight knob on istiod does not move traffic at once: istiod pushes the new route to the gateway over xDS, and only then does the split change.