We are using istio at scale.<p>I have a love-hate relationship with it.
It is very complex and builds on 5 other layer of abstraction (K8s, Envoy, Iptables,...). Grasping what is going on requires you to understand all of those layers first. Istio essentially adds one layer of proxy for all your ingress/egress requests and from an engineering/performance/cost perspective that is not amazing.<p>Once it is working and deployed though it provides a solid set of functionalities as part of the infrastructure directly. AuthN/Z, mTLS, security, metrics and logs are all deployed by default without the end-user having to do anything.<p>Eventually I expect Istio will evolve to a model that makes more sense with Ambient/eBPF (For cost/performance reasons)<p>The community behind Istio is especially helpful and one of the main reasons why we went with this project.