Can Apache Hadoop run reliably inside Istio service mesh with mTLS enabled?

KPG1 — Mon, 29 Dec 2025 09:37:57 GMT

Hi Everyone,

We are evaluating whether Apache Hadoop can run inside an Istio service mesh and would like to understand if this is a supported or practical setup.

Our environment:

Hadoop cluster running on physical machines (bare metal)

No Kerberos

Istio is mandatory

Istio mTLS must be enabled

Hadoop services (NameNode, DataNode, YARN, etc.) would need to communicate through Istio

Our concerns:

Hadoop uses long-lived TCP connections and custom RPC protocols

Istio mTLS intercepts and terminates connections

Unsure if Hadoop components work reliably behind Envoy proxies

Uncertain about the performance and stability impact

Questions:

Has anyone successfully run Hadoop inside Istio with mTLS enabled?

Is this officially supported or just theoretically possible?

Are there known limitations or failure cases (HDFS, YARN, shuffle, etc.)?

Any real-world experience or guidance would be greatly appreciated.

Thanks!

Re: Can Apache Hadoop run reliably inside Istio service mesh with mTLS enabled?

cjervis — Fri, 30 Jan 2026 15:15:56 GMT

@KPG1 If you have not tried yet, I'd suggest asking in Istio's discussion board.