We’re excited to announce that Istio version 1.6 is now available for the IBM Cloud Kubernetes Service managed Istio add-on.

Istio 1.6

This release of Istio comes with simplifications to the control plane with istiod, added debug tools with istioctlWorkloadEntry for joining VM workloads to the mesh, Secure Gateway (SDS), and more. For a more thorough list of new features and changes, check out the release announcement blog and version 1.6 change notes.

Istio add-on customization

After you install the Istio add-on, you can customize a set of Istio configuration options via a config map. These options include extra control over monitoring, logging, and networking in your control plane and service mesh. Use these options to enable envoy access logs, set the outbound traffic policy, enable monitoring dashboards (Prometheus, Grafana, Jaeger, and Kiali), and configure private and HA gateways (beta). For a full list of options, see the documentation.

TLS with ingress traffic

The combination of IBM Cloud Kubernetes Service NLB DNS capabilities and Istio Secure Gateways greatly simplifies the configuration and management of Istio ingress gateway TLS certificates for SSL termination of single and multiple hosts.

IBM Cloud Kubernetes Service provides DNS domain names and matching TLS certificates for clusters. These certificates are stored in a Kubernetes secret in your desired namespace, and IBM keeps them up to date. With Istio Secure Gateway with SDS, Gateway resources can now specify the location of the Kubernetes secret that holds the TLS certs. 

For example, to create a new NLB DNS subdomain and secret with the certificates, run the following command:

ibmcloud ks nlb-dns create classic \
    --ip $GATEWAY_IP \
    --cluster $CLUSTER_NAME \
    --secret-namespace istio-system

Next, configure the Istio Gateway resource to use the certificate:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
  name: my-gateway
    istio: ingressgateway
  - port:
      number: 443
      name: https
      protocol: HTTPS
      mode: SIMPLE
      credentialName: SECRET_NAME # replace with secret name
    - "*"

That’s it! No need to manually update the certs, rename or move secrets, or restart anything. To configure an additional host, you can create NLB DNS subdomain, matching secret, and a new Gateway resource.


IBM Cloud Monitoring with Sysdig is a managed monitoring service that provides operational visibility into the performance and health of applications, services, and infrastructure. For your IBM Cloud Kubernetes Service clusters, it provides out-of-the-box dashboards and alerts for nodes, namespaces, services, deployments, pods, and more. It also integrates with the Istio add-on by automatically scraping merged user application and Istio metrics. Check out the built-in Istio Overview and Service Dashboards:

More information

Check out our documentation to get started with Istio on the IBM Cloud Kubernetes Service

If you have any questions or have any feedback to share, please engage our team via Slack by registering here and join the discussion in the #general or #managed_istio_knative channels on our public IBM Cloud Kubernetes Service Slack.


More from Announcements

Introducing IBM Sterling Order Management on Microsoft Azure

4 min read - IBM and Microsoft believe in providing you with the power of choice so you can leverage the industry-leading omnichannel fulfillment capabilities of Sterling Order Management Software (OMS) along with your existing skills and investment in native Azure services.  IBM and Microsoft provide you with the ability to confidently deploy Sterling OMS on Azure using Azure Red Hat OpenShift (ARO) or Azure Kubernetes Service (AKS), with the added flexibility of using multiple native Azure services. The reference architecture details are available…

IBM TechXchange underscores the importance of AI skilling and partner innovation

3 min read - Generative AI and large language models are poised to impact how we all access and use information. But as organizations race to adopt these new technologies for business, it requires a global ecosystem of partners with industry expertise to identify the right enterprise use-cases for AI and the technical skills to implement the technology. During TechXchange, IBM's premier technical learning event in Las Vegas last week, IBM Partner Plus members including our Strategic Partners, resellers, software vendors, distributors and service…

Introducing Inspiring Voices, a podcast exploring the impactful journeys of great leaders

< 1 min read - Learning about other people's careers, life challenges, and successes is a true source of inspiration that can impact our own ambitions as well as life and business choices in great ways. Brought to you by the Executive Search and Integration team at IBM, the Inspiring Voices podcast will showcase great leaders, taking you inside their personal stories about life, career choices and how to make an impact. In this first episode, host David Jones, Executive Search Lead at IBM, brings…

IBM watsonx Assistant and NICE CXone combine capabilities for a new chapter in CCaaS

5 min read - In an age of instant everything, ensuring a positive customer experience has become a top priority for enterprises. When one third of customers (32%) say they will walk away from a brand they love after just one bad experience (source: PWC), organizations are now applying massive investments to this experience, particularly with their live agents and contact centers.  For many enterprises, that investment includes modernizing their call centers by moving to cloud-based Contact Center as a Service (CCaaS) platforms. CCaaS solutions…