Glossary

Istio's vocabulary mixes Envoy concepts, Kubernetes concepts, and Istio-specific names. This page collects the terms you will hit most often when reading the codebase.

Components and binaries

• Istiod — the merged control plane (pilot/cmd/pilot-discovery). It contains what used to be three separate components: Pilot (config translation, xDS), Citadel (CA), and Galley (config validation). The "d" is for daemon.
• Pilot — informally still used to refer to the xDS / config-translation half of istiod (everything under pilot/).
• Citadel — historical name for the workload CA. Code lives under security/pkg/pki/ and security/pkg/server/ca/.
• Galley — historical name for the configuration validation/distribution component. Removed in 1.6, but the term still appears in tests and integration directory names (tests/integration/galley).
• Pilot-agent (istio-agent) — the per-pod sidecar bootstrap (pilot/cmd/pilot-agent, library pkg/istio-agent). PID 1 in the istio-proxy container. Bootstraps Envoy, runs SDS, and proxies xDS.
• Envoy — the L7 proxy used as the sidecar and gateway data plane. Source for Istio's Envoy build (with WASM and extension filters) lives in istio/proxy.
• Ztunnel — the per-node L4 proxy used in Ambient mode. Written in Rust. Lives in istio/ztunnel; pinned via istio.deps.
• Waypoint — an Envoy deployment that handles L7 features for Ambient workloads (HTTP routing, AuthZ, retries). Configured via the Kubernetes Gateway API.
• Istio-CNI / istio-cni node agent — DaemonSet that installs a CNI plugin and, in Ambient mode, programs in-pod iptables/nftables to redirect traffic to the local ztunnel (cni/).
• Istioctl — the user-facing CLI (istioctl/). Commands include install, analyze, proxy-config, proxy-status, kube-inject, waypoint, ztunnel-config, dashboard, …
• Operator — the install rendering library (operator/pkg/). Driven by the IstioOperator CR. The in-cluster controller mode was removed; today it is invoked client-side via istioctl install.

Modes

• Sidecar mode — the original data plane. Each pod has an istio-proxy (Envoy) container injected. mTLS, routing, and policy live in the sidecar.
• Ambient mode — the sidecar-less data plane introduced in 1.18. L4 features come from a per-node ztunnel; optional L7 features come from per-namespace or per-service-account waypoint Envoys.
• Sidecar injection — adding Envoy to a workload via a mutating admission webhook (or istioctl kube-inject). Code lives in pkg/kube/inject/.
• HBONE — HTTP-Based Overlay Network Environment. The protocol ztunnel speaks between nodes: HTTP/2 CONNECT carrying mTLS-wrapped TCP. Library: pkg/hbone/.

xDS protocol

• xDS — Envoy's family of "discovery service" APIs. Istio uses ADS (aggregated), with subscriptions for CDS (clusters), EDS (endpoints), LDS (listeners), RDS (routes), SDS (secrets), ECDS (extension config), NDS (Istio name table for DNS), and a custom workload API for ztunnels.
• ADS — Aggregated Discovery Service. A single bidirectional gRPC stream that multiplexes all xDS subscriptions. Implementation in pilot/pkg/xds/ads.go, delta variant in delta.go.
• PushContext — an immutable snapshot of all configuration and service state used for one or more xDS pushes. Defined in pilot/pkg/model/push_context.go. Reads are lock-free.
• Push request — a single computation that produces xDS updates for one or more proxies. Driven by XdsServer in pilot/pkg/xds/discovery.go.
• Generator — a function that turns a (Proxy, PushContext, ConfigsUpdated) triple into a list of *discovery.Resource for a given xDS type. Registered per type. Examples: CdsGenerator, EdsGenerator, RouteGenerator. Live in pilot/pkg/xds/ and pilot/pkg/networking/core/.
• Proxy — Istio's representation of an xDS client. Holds metadata, identity, labels, sidecar scope, and merged config relevant to that proxy. Defined in pilot/pkg/model/context.go.
• Sidecar scope — the precomputed slice of the mesh visible to a given proxy after applying Sidecar resources. Limits which services a proxy receives config for.

Configuration model

• MeshConfig — global mesh-wide configuration. Comes from the istio ConfigMap or the IstioOperator meshConfig field. Schema in istio/api mesh/v1alpha1.
• MeshNetworks — multi-network topology (gateways, network labels). Sibling of MeshConfig.
• IstioOperator — install-time CR that drives istioctl install. Defined in istio/api. Backed by operator/pkg/apis/.
• ConfigStore — the abstract interface over Istio's CR storage (CRDs, file, MCP/xDS). Implementations live in pilot/pkg/config/.
• ServiceRegistry — the abstract interface over service-discovery sources (Kubernetes, ServiceEntry, mock). Implementations in pilot/pkg/serviceregistry/.
• CRD client (crdclient) — Istio's wrapper over Kubernetes CRDs that exposes them as ConfigStore entries. pilot/pkg/config/kube/crdclient/.

Networking primitives

• VirtualService — Istio CR for routing rules. Maps host/path patterns to backend subsets, weights, retries, timeouts, faults.
• DestinationRule — Istio CR for client-side traffic policy. Defines subsets, load balancing, connection pools, outlier detection, mTLS settings.
• Gateway (Istio) — Istio CR describing how external traffic enters the mesh. Combined with a VirtualService that has gateways: set.
• Gateway (Kubernetes) — gateway.networking.k8s.io API. Istio implements both the Istio Gateway and the upstream Kubernetes Gateway API; the latter is converted by pilot/pkg/config/kube/gateway/.
• ServiceEntry — Istio CR registering an external service into the mesh's service catalog.
• WorkloadEntry / WorkloadGroup — Istio CRs representing non-Kubernetes workloads (VMs, bare metal) in the mesh.
• Sidecar — Istio CR scoping which configuration a sidecar receives. Used to shrink Envoy config for large meshes.
• EnvoyFilter — escape hatch CR that patches Envoy config directly. Powerful and dangerous; survives at the bottom of the priority order.

Security primitives

• PeerAuthentication — controls mTLS for inbound traffic to workloads (STRICT, PERMISSIVE, DISABLE).
• RequestAuthentication — JWT/JWKS validation rules for inbound HTTP requests.
• AuthorizationPolicy — Istio's L4/L7 authorization rules. Compiled into Envoy RBAC filters.
• SPIFFE / SPIRE — the workload identity framework Istio uses. Identities are SPIFFE URIs of the form spiffe://<trustdomain>/ns/<ns>/sa/<sa>.
• Trust domain — the identity namespace for a mesh (default cluster.local).
• Citadel — see "Components". The CA that signs workload certificates from CSRs.
• SDS — Secret Discovery Service. The Envoy xDS API for fetching certs and keys. The pilot-agent runs an SDS server over a UDS so Envoy never sees private key material on disk.

Internal libraries you will see often

• krt — Kubernetes Declarative Controller Runtime. Istio's home-grown declarative controller framework. Lets you write func(input) -> output transformations and have the framework manage state, dependencies, and event delivery. pkg/kube/krt/. Heavy users: Ambient code, multicluster, status.
• kclient — typed wrappers over Kubernetes informers. pkg/kube/kclient/. Used as the default informer source feeding krt.
• kube/multicluster — secret-driven multi-cluster controller that watches kubeconfig secrets and instantiates per-cluster controllers. pkg/kube/multicluster/.
• kube/inject — the sidecar injector. Both the webhook handler and the rendering of the istio-proxy template. pkg/kube/inject/.
• monitoring — typed Prometheus + OTel metrics wrapper. pkg/monitoring/. All istio_* metrics are registered here.
• log — Istio's logging facade over zap. Adds structured "scopes" so each subsystem can be tuned independently. pkg/log/.
• config schema — generated registry of all known resource kinds, GVKs, and their Go types. pkg/config/schema/.
• bootstrap — Envoy bootstrap config generation (sidecar template). pkg/bootstrap/.

Test framework

• echo — Istio's test client/server. pkg/test/echo/. Used by integration tests to send and observe traffic.
• integration framework — pkg/test/framework/. Provides Kubernetes cluster lifecycle, deployment of Istio under test, and shared test fixtures.

Acronyms cheat sheet

Acronym	Meaning
ADS	Aggregated Discovery Service (xDS variant)
CDS / EDS / LDS / RDS / SDS / ECDS / NDS	Cluster / Endpoint / Listener / Route / Secret / Extension Config / Name table Discovery Service
CNI	Container Network Interface (Kubernetes pod networking standard)
HBONE	HTTP-Based Overlay Network Environment (ztunnel L4 transport)
MCS	Multi-Cluster Services (Kubernetes API)
mTLS	Mutual TLS
MCP	Mesh Configuration Protocol (legacy xDS-based config transport)
OTel	OpenTelemetry
RA	Registration Authority (cert-manager-backed CA delegation)
RBAC	Role-Based Access Control (Envoy filter Istio compiles AuthZ to)
SAN	Subject Alternative Name (X.509)
SDS	Secret Discovery Service
SPIFFE	Secure Production Identity Framework For Everyone
TLSI	Telemetry-related
WASM	WebAssembly (Envoy extensibility mechanism)
ZDS	Ztunnel Discovery Service (pkg/zdsapi) — protocol between istio-cni node agent and the local ztunnel
wDS / WDS	Workload Discovery Service (pkg/workloadapi) — Istiod → ztunnel API