Istio how to limit v1 projects always access v1 projects?

Question

I have 3 projects: A,B,C.
Each project have 2 versions: v1,v2.
How to config istio to limit A(v1) only send request to B(v1) and C(v1)?

Answer 1

This is Istio's Request Routing, as described in this tutorial: https://istio.io/latest/docs/tasks/traffic-management/request-routing/

Basically, you need first to define some DestinationRules to create some subsets based on your versions, e.g.:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  subsets:
  - name: v1
    labels:
      version: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
---

Then, you create some VirtualServices to define the routing rules. Here, you want to use sourceLabels matching, so it's going to be like:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
...
spec:
  hosts:
  - reviews
  http:
  - match:
    - sourceLabels:
        version: v2
    route:
    - destination:
        host: reviews
        subset: v2
  - route:
    - destination:
        host: reviews
        subset: v1

It reads as: if any incoming traffic to service reviews comes from a service that has a label version: v2, it is routed to reviews v2; else as a default rule, it is routed to v1. You can add any number of route rules in that VirtualService, and can repeat the operation for all your services.