Route traffic with proxies and a service mesh

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Traffic and service mesh — 5

nginx — web server and reverse proxy

nginx serves files, proxies to apps, ends TLS and caches.

#nginx -t
#systemctl reload nginx
$curl -I https://shop.example.com

Good practice:

nginx -t before every reload; reload, do not restart.
Timeouts, client_max_body_size and security headers set on purpose.

9.2

HAProxy — fast load balancing

haproxy balances TCP and HTTP traffic with health checks and a stats page.

#haproxy -c -f /etc/haproxy/haproxy.cfg
#systemctl reload haproxy
$echo "show stat" | sudo socat stdio /run/haproxy/admin.sock | cut -d, -f1,2,18 | column -s, -t

9.3

Traefik — the proxy that reads Docker and Kubernetes

traefik finds services by itself (labels, Ingress, IngressRoute) and gets Let's Encrypt certificates.

$kubectl get ingressroute -A
$docker run -d -l traefik.http.routers.web.rule='Host(`shop.local`)' nginx:1.27

9.4

Istio — a service mesh

istioctl installs and checks Istio: mTLS between pods, retries, and canary traffic splits.

$istioctl install --set profile=default -y
$istioctl analyze -A
$istioctl proxy-status

9.5

Certbot — free TLS certificates

certbot gets and renews Let's Encrypt certificates for servers outside Kubernetes (in Kubernetes: cert-manager).

#certbot --nginx -d shop.example.com
#certbot renew --dry-run

9.6

Release with less risk

Three ways to put a new version in front of users.

Way	How	Tool
Rolling update	Replace pods one by one	Kubernetes Deployment (default)
Blue/green	Run the new version beside the old, switch all traffic at once	Two Services, a switch in the Ingress or LB
Canary	Send 5–10 % of traffic to the new version, watch, then more	Istio `VirtualService` weights, Argo Rollouts, nginx `canary` annotations

Remember

A release strategy only works with good health checks and dashboards that show errors per version.

Route traffic with proxies and a service mesh

All commands in this chapter