GLYPH<SM590000> Resiliency : The capability to increase micro services application performance and fault tolerance by performing resiliency tests, error and fault isolation and failed service ejection. 

## Secure 

Istio implements a Role-based Access Control (RBAC) which allow a specific determination on which service can connect to which other services. Istio uses Secure Production Identity Framework for Everyone (SPIFFE) to identify the ServiceAccount of a micro service uniquely and use that to make sure that communications are allowed. 

## Control 

Istio provides a set of policies that allows control to be enforced based on data collected. 

## Observe 

While enforcing policies, Istio allows observing your microservices through integrated telemetry, monitoring, tracing, and logging. 

An Istio service mesh is logically split into a data plane and a control plane. GLYPH<SM590000> The data plane  is composed of a set of intelligent proxies ( Envoy ) deployed as sidecars. These proxies mediate and control all network communication between microservices along with Mixer,  a general-purpose policy and telemetry hub. 

GLYPH<SM590000> The control plane  manages and configures the proxies to route traffic. Additionally, the control plane configures Mixers to enforce policies and collect telemetry. 

Figure 5-7 on page 166 shows the Istio service mesh architecture. 

