Istio is a service mesh platform that provides traffic management, security, and observability for microservices. It consists of a control plane (Istiod), data plane proxies (Envoy or Ztunnel), and operational tools (istioctl, operator). The system secures service-to-service communication via mTLS and authorization policies, manages traffic routing and load balancing, and collects telemetry data. Architecture follows a modular design with clear separation between control plane (configuration distribution, certificate management), data plane (traffic interception and policy enforcement), and plug-in points (CNI, WebAssembly, gateway APIs). Key entry points include istioctl CLI, pilot-discovery control plane, and CNI node agent. The codebase demonstrates strong engineering practices with extensive testing, interface-based abstractions, and reusable utility libraries.
Yggdrasil is an Envoy control plane that watches Kubernetes ingress resources across multiple clusters and generates dynamic configuration for Envoy proxies. It implements a modular architecture with separate packages for Kubernetes integration (pkg/k8s) and Envoy configuration generation (pkg/envoy). The system uses Kubernetes informers to watch resources, aggregates events from multiple clusters, translates ingress objects into Envoy listeners and clusters, and serves the configuration via xDS gRPC protocol. It also provides metrics and health endpoints for monitoring. The code demonstrates good separation of concerns, proper use of Kubernetes client-go patterns, and clean abstraction for handling multiple Kubernetes API versions.