( https://istio.io/docs/concepts/what-is-istio/ ). That way, the reader can understand  how each component contributes to Istio’s ability to connect,  secure, control, and observe  microservices. Istio uses an extended version of the Envoy proxy. Envoy is a high-performance proxy that is  developed in C++ to mediate all inbound and outbound traffic for all services in the service  mesh. Istio leverages Envoy’s many built-in features, for example: Envoy Mixer Pilot Citadel Chapter 5. IBM Cloud Pak for Integration  167 Citadel provides strong service-to-service and end-user authentication with built-in identity  and credential management. Citadel can be used to upgrade unencrypted traffic in the  service mesh. Using Citadel, operators can enforce policies based on service identity rather  than on network controls. Istio’s authorization  feature also allows you to control who can  access services within the mesh. Pilot converts high level routing rules that control traffic behavior into Envoy-specific  configurations, and propagates them to the sidecars at run time. Pilot abstracts  platform-specific service discovery mechanisms and synthesizes them into a standard format  that any sidecar can use, as long as that sidecar conforms with the Envoy data plane APIs.  Pilot provides service discovery for the Envoy sidecars, traffic management capabilities for  intelligent routing (like A/B tests, canary rollouts), and resiliency (timeouts, retries, circuit  breakers). Mixer enforces access control and usage policies across the service mesh, and collects  telemetry data from the Envoy proxy and other services. The proxy extracts request level  attributes, and sends them to Mixer for evaluation. Mixer includes a flexible plug-in model. This model enables Istio to interface with a variety of  host environments and infrastructure backends. Thus, Istio abstracts the Envoy proxy and  Istio-managed services from these details. The sidecar proxy model also allows the addition of Istio capabilities to an existing  deployment with no need to rearchitect or rewrite code. Envoy is deployed as a sidecar container alongside your application container. It is deployed  in the same Kubernetes pod such that it is always present and shares the same lifecycle. This  deployment allows Istio to extract a wealth of signals about traffic behavior as attributes. Istio  can, in turn, use these attributes in Mixer to enforce policy decisions, and send them to  monitoring systems to provide information about the behavior of the entire mesh. GLYPH<SM590000> Dynamic service discovery GLYPH<SM590000> Load balancing GLYPH<SM590000> TLS termination GLYPH<SM590000> HTTP/2 and gRPC proxies GLYPH<SM590000> Circuit breakers GLYPH<SM590000> Health checks GLYPH<SM590000> Fault injection GLYPH<SM590000> Staged rollouts with percentage-based traffic split GLYPH<SM590000> Rich metrics