Alek's Blog

4 posts with tag #service-mesh

Blog post cover image
kubernetesistioenvoynetworkingsecurityservice-meshgateway-apirbacweb-scraping

Blocking AI Crawlers on Istio: AuthorizationPolicy's Ceiling and Envoy's Full-String Regex Trap

Blocking ~160 known AI-crawler user agents at an Istio ingress gateway without Lua: why AuthorizationPolicy cannot do substring header matching, and why a single safe_regex alternation would silently never match anyway.

Blocking AI Crawlers on Istio: AuthorizationPolicy's Ceiling and Envoy's Full-String Regex Trap
Diagram: an AuthorizationPolicy using ipBlocks reads Envoy's direct_remote_ip (the load balancer), while remoteIpBlocks reads remote_ip (the real client)
kubernetesistioenvoynetworkingsecurityservice-meshgateway-apihttp2

Istio AuthorizationPolicy & HTTP/2 Coalescing

Two Istio/Envoy pitfalls: AuthorizationPolicy IP matching (direct_remote_ip vs. remote_ip) and HTTP/2 connection coalescing across per-hostname listeners.

Istio AuthorizationPolicy & HTTP/2 Coalescing
Diagram: sidecar traffic flow in a Linkerd service mesh
kubernetesistiolinkerdservice-meshmtlsnetworkingsecurity

Istio vs. Linkerd: Service Mesh on Kubernetes

Comparing Istio 1.29 (sidecar mode) and Linkerd 2.19: data plane, mTLS, egress, resource overhead, observability, and when to use each.

Istio vs. Linkerd: Service Mesh on Kubernetes
Diagram: traffic flow through Istio Ambient's ztunnel data plane
kubernetesistioenvoygateway-apinetworkingsecuritymtlsservice-meshciliumaksgke

Istio vs. Envoy Gateway: Gateway API on Kubernetes

Comparing Istio and Envoy Gateway as Gateway API implementations: mTLS, egress, Cilium, managed cloud specifics (AKS, GKE, OVH MKS), and real client IP.

Istio vs. Envoy Gateway: Gateway API on Kubernetes