Follow requests through an Istio mesh: TLS ends at the Gateway, the VirtualService routes by header and weight, the DestinationRule sets mTLS and ejects failing pods. Change the weight on istiod, break a pod, or press ▶ Guided tour.
The istio-ingressgateway is an Envoy proxy at the edge; the Gateway resource opens its ports and names the TLS certificate. The VirtualService bound to it routes requests, here by header and by weight between subsets. The DestinationRule defines those subsets by pod label, sets mutual TLS for the hop to each pod's Envoy sidecar, and turns on outlier detection, which ejects pods that keep failing. istiod turns all of this into Envoy configuration and pushes it over xDS, so a change takes effect only once it has been pushed.