( https://istio.io/docs/concepts/what-is-istio/ ). That way, the reader can understand how each component contributes to Istio’s ability to connect, secure, control, and observe microservices. 

## Envoy 

Istio uses an extended version of the Envoy proxy. Envoy is a high-performance proxy that is developed in C++ to mediate all inbound and outbound traffic for all services in the service mesh. Istio leverages Envoy’s many built-in features, for example: 

GLYPH<SM590000> Dynamic service discovery 

GLYPH<SM590000> Load balancing 

GLYPH<SM590000> TLS termination 

GLYPH<SM590000> HTTP/2 and gRPC proxies 

GLYPH<SM590000> Circuit breakers 

GLYPH<SM590000> Health checks 

GLYPH<SM590000> Staged rollouts with percentage-based traffic split 

GLYPH<SM590000> Fault injection 

GLYPH<SM590000> Rich metrics 

Envoy is deployed as a sidecar container alongside your application container. It is deployed in the same Kubernetes pod such that it is always present and shares the same lifecycle. This deployment allows Istio to extract a wealth of signals about traffic behavior as attributes. Istio can, in turn, use these attributes in Mixer to enforce policy decisions, and send them to monitoring systems to provide information about the behavior of the entire mesh. 

The sidecar proxy model also allows the addition of Istio capabilities to an existing deployment with no need to rearchitect or rewrite code. 

## Mixer 

Mixer enforces access control and usage policies across the service mesh, and collects telemetry data from the Envoy proxy and other services. The proxy extracts request level attributes, and sends them to Mixer for evaluation. 

Mixer includes a flexible plug-in model. This model enables Istio to interface with a variety of host environments and infrastructure backends. Thus, Istio abstracts the Envoy proxy and Istio-managed services from these details. 

## Pilot 

Pilot provides service discovery for the Envoy sidecars, traffic management capabilities for intelligent routing (like A/B tests, canary rollouts), and resiliency (timeouts, retries, circuit breakers). 

Pilot converts high level routing rules that control traffic behavior into Envoy-specific configurations, and propagates them to the sidecars at run time. Pilot abstracts platform-specific service discovery mechanisms and synthesizes them into a standard format that any sidecar can use, as long as that sidecar conforms with the Envoy data plane APIs. 

## Citadel 

Citadel provides strong service-to-service and end-user authentication with built-in identity and credential management. Citadel can be used to upgrade unencrypted traffic in the service mesh. Using Citadel, operators can enforce policies based on service identity rather than on network controls. Istio’s authorization feature also allows you to control who can access services within the mesh. 

