Istio is completely an open source service mesh that layers transparently onto existing distributed applications. Istio v1.0 got announced last month and is ready for production. It is written completely in Go Language and its a fully grown platform which provides APIs that let it integrate into any logging platform, or telemetry or policy system. This project adds a very tiny overhead to your system. It is hosted on GitHub under this link. Istio’s diverse feature set lets you successfully, and efficiently, run a distributed microservice architecture, and provides a uniform way to secure, connect, and monitor microservices.
Istio is composed of these components:
- Envoy – Sidecar proxies per microservice to handle ingress/egress traffic between services in the cluster and from a service to external services. The proxies form a secure microservice mesh providing a rich set of functions like discovery, rich layer-7 routing, circuit breakers, policy enforcement and telemetry recording/reporting functions.
Note: The service mesh is not an overlay network. It simplifies and enhances how microservices in an application talk to each other over the network provided by the underlying platform.
- Mixer – Central component that is leveraged by the proxies and microservices to enforce policies such as authorization, rate limits, quotas, authentication, request tracing and telemetry collection.
- Pilot – A component responsible for configuring the proxies at runtime.
- Citadel – A centralized component responsible for certificate issuance and rotation.
- Node Agent – A per-node component responsible for certificate issuance and rotation.
- Galley– Central component for validating, ingesting, aggregating, transforming and distributing config within Istio.
What benefits does Istio bring?
Figure: The sidecar incepts all the network traffic
- Istio lets you connect, secure, control, and observe services.
- It helps to reduce the complexity of service deployments and eases the strain on your development teams.
- It provides developers and DevOps fine-grained visibility and control over traffic without requiring any changes to application code.
- It provides CIOs with the necessary tools needed to help enforce security and compliance requirements across the enterprise.
- It provides behavioral insights & operational control over the service mesh as a whole.
- Istio makes it easy to create a network of deployed services with automatic Load Balancing for HTTP, gRPC, Web Socket & TCP Traffic.
- It provides fine-grained control of traffic behavior with rich routing rules, retries, failovers, and fault injection.
- It enables a pluggable policy layer and configuration API supporting access controls, rate limits and quotas.
- Istio provides automatic metrics, logs, and traces for all traffic within a cluster, including cluster ingress and egress.
- It provides secure service-to-service communication in a cluster with strong identity-based authentication and authorization.
Istio currently supports Kubernetes.Under this blog post, I will showcase how can one bring up Istio on Play with Kubernetes Platform.
Open https://labs.play-with-k8s.com/ to access Kubernetes Playground.
Click on the Login button to authenticate with Docker Hub or GitHub ID.
Once you start the session, you will have your own lab environment.
Adding First Kubernetes Node
Click on “Add New Instance” on the left to build your first Kubernetes Cluster node. It automatically names it as “node1”. Each instance has Docker Community Edition (CE) and Kubeadm already pre-installed. This node will be treated as the master node for our cluster.
Bootstrapping the Master Node
You can bootstrap the Kubernetes cluster by initializing the master (node1) node with the below script. Copy this script content into bootstrap.sh file and make it executable using “chmod +x bootstrap.sh” command.
When you execute this script, as part of initialization, the kubeadm write several configuration files needed, setup RBAC and deployed Kubernetes control plane components (like kube-apiserver, kube-dns, kube-proxy, etcd, etc.). Control plane components are deployed as Docker containers.
Copy the above kubeadm join token command and save it for the next step. This command will be used to join other nodes to your cluster.
Adding Worker Nodes
Click on “Add New Node” to add a new worker node.
Checking the Cluster Status
Verifying the running Pods
Installing Istio 1.0.0
Istio is deployed in a separate Kubernetes namespace istio-system. We will verify it later. As of now, you can copy the below content in a file called install_istio.sh and save it. You can make it executable and run it to install Istio and related tools.
#!/bin/bash
curl -L https://git.io/getLatestIstio | sh –
export PATH=$PWD/bin:$PATH
cd istio-1.0.0
kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml
kubectl apply -f install/kubernetes/istio-demo.yaml
kubectl get svc -n istio-system
kubectl get pods -n istio-system
You should be able to see screen flooding with the below output.
As shown above, it will enable the Prometheus, ServiceGraph, Jaeger, Grafana, and Zipkin by default.
Please note – While executing this script, it might end up with the below error message –
unable to recognize “install/kubernetes/istio-demo.yaml”: no matches for admissionregistration.k8s.io/, Kind=MutatingWebhookConfiguration
The error message is expected.
As soon as the command gets executed completely, you should be able to see a long list of ports which gets displayed at the top center of the page.
Verifying the Services
Exposing the Services
To expose Prometheus, Grafana & Servicegraph services, you will need to delete the existing services and then use NodePort instead of ClusterIP so as to access the service using the port displayed on the top of the instance page. (as shown below)
You should be able to access Grafana page by clicking on “30004” port and Prometheus page by clicking on “30003”.
You can check Prometheus metrics by selecting the necessary option as shown below:
Under Grafana Page, you can add “Data Source” for Prometheus and ensure that the dashboard is up and running:
Congratulations! You have installed Istio on Kubernetes cluster. Below listed services have been installed on K8s playground:
- Istio Controllers and related RBAC rules
- Istio Custom Resource Definitions
- Prometheus and Grafana for Monitoring
- Jeager for Distributed Tracing
- Istio Sidecar Injector (we’ll take a look next section)
Installing Istioctl
Istioctl is configuration command line utility of Istio. It helps to create, list, modify and delete configuration resources in the Istio system.
Deploying the Sample BookInfo Application
Now Istio is installed and verified, you can deploy one of the sample applications provided with the installation- BookInfo. This is a simple mock bookstore application made up of four services that provide a web product page, book details, reviews (with several versions of the review service), and ratings – all managed using Istio.
Deploying BookInfo Services
| [node1 istio-1.0.0]$ kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
service “details” created deployment “details-v1” created service “ratings” created deployment “ratings-v1” created service “reviews” created deployment “reviews-v1” created deployment “reviews-v2” created deployment “reviews-v3” created service “productpage” created deployment “productpage-v1” created |
| [node1 istio-1.0.0]$ istioctl create -f samples/bookinfo/networking/bookinfo-gateway.yaml
Created config gateway/default/bookinfo-gateway at revision 13436 Created config virtual-service/default/bookinfo at revision 13438
|
Verifying BookInfo Application
| [node1 istio-1.0.0]$ kubectl get services
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE details ClusterIP 10.97.29.111 <none> 9080/TCP 1m kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 1h productpage ClusterIP 10.106.144.171 <none> 9080/TCP 1m ratings ClusterIP 10.111.164.221 <none> 9080/TCP 1m reviews ClusterIP 10.99.195.21 <none> 9080/TCP 1m [node1 istio-1.0.0]$ curl 10.106.144.171:9080 <!DOCTYPE html> <html> <head> <title>Simple Bookstore App</title> <meta charset=”utf-8″> <meta http-equiv=”X-UA-Compatible” content=”IE=edge”> <meta name=”viewport” content=”width=device-width, initial-scale=1″>
<!– Latest compiled and minified CSS –> <link rel=”stylesheet” href=”https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css”>
<!– Optional theme –> <link rel=”stylesheet” href=”https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css”>
</head> <body>
<p><h3>Hello! This is a simple bookstore application consisting of three services as shown below</h3></p>
<table class=”table table-condensed table-bordered table-hover”><tr><th>endpoint</th><td>details</td></tr><tr><th>name</th><td>http://details:9080</td></tr><tr><th>children</th><td><table class=”table table-condensed table-bordered table-hover”><tr><th>endpoint</th><th>name</th><th>children</th></tr><tr><td>details</td><td>http://details:9080</td><td></td></tr><tr><td>reviews</td><td>http://reviews:9080</td><td><table class=”table table-condensedtable-bordered table-hover”><tr><th>endpoint</th><th>name</th><th>children</th></tr><tr><td>ratings</td><td>http://ratings:9080</td><td></td></tr></table></td></tr></table></td></tr></table>
<p><h4>Click on one of the links below to auto generate a request to the backend as a real user or a tester </h4></p> <p><a href=”/productpage?u=normal”>Normal user</a></p> <p><a href=”/productpage?u=test”>Test user</a></p>
<!– Latest compiled and minified JavaScript –> <script src=”https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js”></script>
<!– Latest compiled and minified JavaScript –> <script src=”https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js”></script>
</body> </html> |
Accessing it via Web URL
| [node1 istio-1.0.0]$ kubectl get services
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE details ClusterIP 10.97.29.111 <none> 9080/TCP 2m kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 1h productpage ClusterIP 10.106.144.171 <none> 9080/TCP 2m ratings ClusterIP 10.111.164.221 <none> 9080/TCP 2m reviews ClusterIP 10.99.195.21 <none> 9080/TCP 2m [node1 istio-1.0.0]$ kubectl delete svc productpage service “productpage” deleted [node1 istio-1.0.0]$ kubectl create service nodeport productpage –tcp=9080 –node-port=30010 service “productpage” created |
You should now be able the BookInfo Sample as shown below:
In my next blog post, I will showcase how to bring up Kubernetes Dashboard under Play with Kubernetes Platform.
Comments are closed.