Istio past HTTP, read against EKS
Istio on EKS covers the day-2 basics: what injection adds, the webhook port, PodSecurity, identity, upgrades and ambient mode. This page reads a second batch of Istio material for the questions that page leaves open. What does a mesh do for traffic that is not HTTP? Can the data plane be something other than Envoy? And does a resilience policy written for Istio actually behave the way its comments say?
The sources:
| source | date | what it is |
|---|---|---|
| Tencent Music's service mesh practice with Istio and Aeraki, Huabing Zhao (Tencent Cloud) and Wang Chengqiang (Tencent Music), IstioCon | 2022 | 41 slides, in Chinese: Aeraki and MetaProtocol, then Tencent Music's rollout |
| Apache APISIX from Gateway to Full Traffic Proxy with Istio, Jintao Zhang (API7.ai), IstioCon | April 2022 | 16 slides: APISIX as the Istio data plane instead of Envoy |
| Understanding Envoy Proxy Sidecar Injection and Traffic Hijacking in Istio, Jimmy Song | 2018, last updated March 2022 | blog post on the init container and iptables redirect |
| istio-action-items.md | 2026 | 87 action items (W15–W23) distilled from the istio.io docs: ambient multicluster, migration, upgrades, troubleshooting, security, traffic APIs |
| istio-traffic-demo.yaml and apply-istio-resilience.py | 2026 | a v1/v2 canary demo, and a script that patches every DestinationRule and VirtualService in a Kubeflow cluster |
| a 15-entry Istio catalogue from awesome-cloud-native lists | various | tutorials, UIs, operators, an MCP server, the ICA certification |
The istio.io docs scrape (
istio.md, 573 KB, identical to istio-latest-docs-setup.md) was used only to check claims against.At a glance
| question | the sources' answer | on AWS today |
|---|---|---|
| L7 routing for Dubbo, Thrift, private RPC | Aeraki + MetaProtocol: write a codec of a few hundred lines; Aeraki is the control plane | no AWS service. Lattice and Service Connect are HTTP-family only; anything else is TCP. Aeraki on EKS is self-managed, and its last release was August 2023 |
| a non-Envoy data plane | APISIX via xDS (api7/Amesh), swap the injection template | Amesh last pushed June 2023, release v0.0.2. Use APISIX at the edge, not in the mesh |
| bridging an existing registry into the mesh | Polaris2Istio, Consul2Istio, Dubbo2Istio, Eureka2Istio → ServiceEntry | Cloud Map has no watch API, only polling with DiscoverInstancesRevision; no AWS-maintained bridge |
| merging two meshes | three phases through gateways and ServiceEntry | the same on EKS; Istio revisions handle version moves inside one mesh |
| canary, mirror, fault injection | demo manifest, all in one VirtualService | Lattice: weighted forward and header match, no mirror, no fault action. ALB: the same. FIS: pod-level faults, not per-request |
| resilience defaults for every route | the script, mesh-wide | correct intent, three bugs below |
1. Tencent Music: L7 control for protocols the mesh treats as TCP
The talk's starting point is the one most mesh pitches skip. Istio and Envoy manage HTTP, HTTP/2 and gRPC at layer 7. Everything else, including Thrift, Dubbo, Redis, Kafka and every in-house RPC, is a TCP stream. For TCP you get L4 load balancing, retries on connection errors, IP-and-port routing and byte counters. You do not get routing on a method name, retries on an application error code, per-request metrics or fault injection.
Tencent Music's estate, from slide 22:
- Protocols: HTTP, gRPC and private protocols.
- Meshes: Istio 1.3.6, Istio 1.10 and other heterogeneous meshes, plus services in no mesh.
- Service discovery: L5, Polaris, Consul and DNS.
- Languages and platforms: C++, Go and Node.js, on Kubernetes and VMs.
What Aeraki changes. The first version of Aeraki generated config for Envoy's built-in Dubbo and Thrift filters. Those filters lacked RDS, rate limiting, consistent hashing, mirroring and tracing, and adding a protocol meant a whole Envoy TCP filter plus a control-plane plugin. The second version splits the work:
- MetaProtocol Proxy, an Envoy filter, implements the protocol-independent parts once: routing from RDS, load balancing, circuit breaking, local and global rate limiting, header mutation, request metrics and tracing.
- A protocol only implements
decode,encodeandonError. The decoder fills a key-valueMetadatamap, routing matches on it, and filters write aMutationmap that the encoder applies. The talk puts this at "a few hundred lines". - Aeraki runs beside istiod as a second control plane. It turns its own CRDs (
ApplicationProtocol,MetaRouter) into the MetaProtocol config, so Istio itself is unmodified.
Tencent Music's demos show routing by command word, so each command goes to its own version, and local rate limiting of one sub-command while others pass. Full-link colouring by branch, which gives isolated dev environments on shared clusters, is the payoff they name.
Read against AWS. Check what each AWS L7 service can parse:
| AWS service | protocols it understands | for a Thrift or private-RPC call |
|---|---|---|
| VPC Lattice | listeners HTTP, HTTPS, TLS_PASSTHROUGH; target groups HTTP, HTTPS, TCP with versions HTTP1, HTTP2, GRPC | TLS passthrough or TCP: no method routing, no per-request metrics |
| ECS Service Connect | appProtocol: http, http2, grpc | TCP metrics only |
| ALB | HTTP, HTTPS (with gRPC) | not applicable |
| NLB | TCP, TLS, UDP, TCP_UDP, QUIC | connection-level only |
App Mesh, which reached end of support on 30 September 2026, was HTTP-family too. No AWS service has ever offered L7 governance for a non-HTTP RPC protocol. For a team in Tencent Music's position on AWS there are three options:
- Run Aeraki on EKS beside self-managed Istio. Be aware of its pace: the last release is 1.4.1 of August 2023, and the repository was last pushed in December 2025. The MetaProtocol proxy repository was last pushed in March 2025. A codec is your code, built against an Envoy version that Aeraki pins, so every Istio upgrade becomes an Aeraki compatibility question.
- Move the protocol to gRPC at the edges that need governance. Lattice, Service Connect and ALB all route gRPC by path, which is
/package.Service/Method, so method routing comes for free. - Leave it as TCP and put the logic in the client library. That is what Tencent Music was moving away from, but with three languages and four discovery systems it may still be cheaper than option 1.
The service-discovery bridge. Tencent Music watched Polaris for changes and wrote
ServiceEntry objects, so services outside the mesh were reachable by their old names. Migration then went through four stages, from "outside the mesh, old discovery" to "inside the mesh, Kubernetes Service name, old name kept as an alias". On AWS the registry is Cloud Map, and its API has no watch or subscribe call. The closest is DiscoverInstancesRevision, which returns a revision number to poll. A Cloud Map → ServiceEntry bridge is a controller you write, polling.Merging meshes. Their three-phase merge of an old control plane into a new one runs as follows:
- Bridge: gateways back to the old mesh, plus
ServiceEntryobjects pointing at them, generated by a program. - Shift: move traffic weight to the new mesh, leaving placeholder entries in the old one.
- Clean up: remove the old entries.
This works unchanged on EKS. It is also the only way to merge two separate control planes. For moving between Istio versions inside one mesh, revisions and tags do the job with less work; see section 7 of Istio on EKS . Note that Istio 1.3.6, one of their production versions, was already out of support when the talk was given. The current release is 1.31.1, from 21 September 2026.
2. APISIX as the Istio data plane
Jintao Zhang's case for APISIX in place of Envoy has three arguments:
- Easier to learn: few concepts, "three minutes to start", against learning Envoy's filter configuration.
- Easier to extend: NGINX and Lua, plus plugins in other languages.
- Fewer known vulnerabilities.
The mechanism is the one Jimmy Song's post describes for Envoy. APISIX gains an xDS client and drops its etcd dependency. You then replace the
proxy_init and proxy containers in Istio's injection template, so istiod pushes xDS to APISIX instead of Envoy. The implementation was published as api7/amesh, and the plan was to donate it to the ASF as an APISIX sub-project.Status, 8 October 2026.
api7/Amesh is not archived, but it was last pushed on 7 June 2023, and its last release is v0.0.2 of August 2022. No Apache-hosted successor was found under the obvious names. APISIX itself is very active (pushed today, 17,000 stars).On EKS:
- At the edge, APISIX is a reasonable ingress gateway, or an API gateway behind an NLB, where its plugin model is the point.
- Inside the mesh, do not adopt Amesh. Istio's own direction is ambient mode, which moves L7 into a waypoint that is Envoy. A custom injection template is also the first thing an Istio upgrade breaks.
- The "fewer CVEs" claim was not checked. A smaller CVE count can also mean less scrutiny.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article