Skip to main content

Weighted canary — D1 · D2

CONDITION 3 · weighted split — 90% / 10%? — weight 90% · production → D1 · weight 10% · canary → D2 (ServiceEntry)

Weighted backendRefs · canary (RKE2 guest ingress): the HTTPRoute splits the request, and istio-cni decides per target whether ztunnel is on the path. The shared ingress trunk precedes both.

Standard K8s routingkube-proxy / Calicoistio-cni interceptionztunnel proxyHBONE / mTLSGateway API ingressHTTPRouteMetalLB LoadBalancerVIPPolicy miss / bypassed
D1 · 90% — production to mesh
LINUX KERNEL SPACE · NODE-1USER SPACE · NODE-1KERNEL SPACE · CONT.MESH DESTINATION NAMESPACE1 · Policy MATCH → redirectistio-cniInterception check · target in mesh2 · HBONE/mTLS → re-enter kernelztunnelWraps in HBONE / mTLS3 · Standard routekube-proxyTranslate to Pod IP4 · Deliver encrypted trafficCalicoRouting engine (CNI)Mesh Target PodReceives HBONE / mTLS traffic
D2 · 10% — canary to external VM
LINUX KERNEL SPACE · NODE-11 · Policy MISS → standard routingistio-cniTarget IP external✕ztunnelIdle · bypassed2 · Route to gateway / egressCalicoRouting engine (CNI)3 · Plaintext TCPPhysical NIC / Guest VM NetworkEgress off the nodeExternal Target VM0 mesh components

D1 · 90% — production to mesh​

In-mesh destination · policy MATCH

  • 1 — istio-cni · Interception check · target in mesh — Policy MATCH → redirect.
  • 2 — ztunnel wraps in HBONE / mTLS — HBONE/mTLS → re-enter kernel.
  • 3 — kube-proxy translates to Pod IP — standard route.
  • 4 — Calico delivers encrypted traffic to the Mesh Target Pod, which receives HBONE / mTLS traffic.

D2 · 10% — canary to external VM​

External target via ServiceEntry · policy MISS

  • 1 — istio-cni · Target IP external — Policy MISS → standard routing; ztunnel idle · bypassed.
  • 2 — Calico routes to gateway / egress.
  • 3 — Physical NIC / Guest VM Network — egress off the node; plaintext TCP to the External Target VM (0 mesh components).