mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 21:18:04 +00:00
Remove unneeded intermediate folders
This commit is contained in:
Billy Tat
+25
@@ -0,0 +1,25 @@
|
||||
---
|
||||
title: Additional Steps for Project Network Isolation
|
||||
weight: 4
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/canal-and-project-network
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/canal-and-project-network/
|
||||
---
|
||||
|
||||
In clusters where:
|
||||
|
||||
- You are using the Canal network plugin with Rancher before v2.5.8, or you are using Rancher v2.5.8+ with an any RKE network plug-in that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin
|
||||
- The Project Network Isolation option is enabled
|
||||
- You install the Istio Ingress module
|
||||
|
||||
The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be inaccessible from the namespace where Istio is installed. You have two options.
|
||||
|
||||
The first option is to add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines:
|
||||
|
||||
```
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: istio-ingressgateway
|
||||
```
|
||||
|
||||
The second option is to move the `istio-system` namespace to the `system` project, which by default is excluded from the network isolation.
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
title: Configuration Options
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/
|
||||
---
|
||||
|
||||
- [Egress Support](#egress-support)
|
||||
- [Enabling Automatic Sidecar Injection](#enabling-automatic-sidecar-injection)
|
||||
- [Overlay File](#overlay-file)
|
||||
- [Selectors and Scrape Configs](#selectors-and-scrape-configs)
|
||||
- [Enable Istio with Pod Security Policies](#enable-istio-with-pod-security-policies)
|
||||
- [Additional Steps for Installing Istio on an RKE2 Cluster](#additional-steps-for-installing-istio-on-an-rke2-cluster)
|
||||
- [Additional Steps for Project Network Isolation](#additional-steps-for-project-network-isolation)
|
||||
|
||||
### Egress Support
|
||||
|
||||
By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](#overlay-file).
|
||||
|
||||
### Enabling Automatic Sidecar Injection
|
||||
|
||||
Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed.
|
||||
|
||||
### Overlay File
|
||||
|
||||
An Overlay File is designed to support extensive configuration of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario.
|
||||
|
||||
The Overlay File will add configuration on top of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation.
|
||||
|
||||
For more information on Overlay Files, refer to the [Istio documentation.](https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings)
|
||||
|
||||
### Selectors and Scrape Configs
|
||||
|
||||
The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` which enables monitoring across all namespaces by default. This ensures you can view traffic, metrics and graphs for resources deployed in a namespace with `istio-injection=enabled` label.
|
||||
|
||||
If you would like to limit Prometheus to specific namespaces, set `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`. Once you do this, you will need to add additional configuration to continue to monitor your resources.
|
||||
|
||||
For details, refer to [this section.](./selectors-and-scrape)
|
||||
|
||||
### Enable Istio with Pod Security Policies
|
||||
|
||||
Refer to [this section.](./enable-istio-with-psp)
|
||||
|
||||
### Additional Steps for Installing Istio on an RKE2 Cluster
|
||||
|
||||
Refer to [this section.](./rke2)
|
||||
|
||||
### Additional Steps for Project Network Isolation
|
||||
|
||||
Refer to [this section.](./canal-and-project-network)
|
||||
+114
@@ -0,0 +1,114 @@
|
||||
---
|
||||
title: Enable Istio with Pod Security Policies
|
||||
weight: 1
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/enable-istio-in-cluster/enable-istio-with-psp
|
||||
- /rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/enable-istio-in-cluster/enable-istio-with-psp
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/enable-istio-with-psp
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/enable-istio-with-psp/
|
||||
---
|
||||
|
||||
import Tabs from '@theme/Tabs';
|
||||
import TabItem from '@theme/TabItem';
|
||||
|
||||
If you have restrictive Pod Security Policies enabled, then Istio may not be able to function correctly, because it needs certain permissions in order to install itself and manage pod infrastructure. In this section, we will configure a cluster with PSPs enabled for an Istio install, and also set up the Istio CNI plugin.
|
||||
|
||||
The Istio CNI plugin removes the need for each application pod to have a privileged `NET_ADMIN` container. For further information, see the [Istio CNI Plugin docs](https://istio.io/docs/setup/additional-setup/cni). Please note that the [Istio CNI Plugin is in alpha](https://istio.io/about/feature-stages/).
|
||||
|
||||
The steps differ based on the Rancher version.
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="v2.5.4+">
|
||||
|
||||
> **Prerequisites:**
|
||||
>
|
||||
> - The cluster must be an RKE Kubernetes cluster.
|
||||
> - The cluster must have been created with a default PodSecurityPolicy.
|
||||
>
|
||||
> To enable pod security policy support when creating a Kubernetes cluster in the Rancher UI, go to <b>Advanced Options.</b> In the <b>Pod Security Policy Support</b> section, click <b>Enabled.</b> Then select a default pod security policy.
|
||||
|
||||
1. [Set the PodSecurityPolicy to unrestricted](#1-set-the-podsecuritypolicy-to-unrestricted)
|
||||
2. [Enable the CNI](#2-enable-the-cni)
|
||||
3. [Verify that the CNI is working.](#3-verify-that-the-cni-is-working)
|
||||
|
||||
### 1. Set the PodSecurityPolicy to unrestricted
|
||||
|
||||
An unrestricted PSP allows Istio to be installed.
|
||||
|
||||
Set the PSP to `unrestricted` in the project where is Istio is installed, or the project where you plan to install Istio.
|
||||
|
||||
1. From the cluster view of the **Cluster Manager,** select **Projects/Namespaces.**
|
||||
1. Find the **Project: System** and select the **⋮ > Edit**.
|
||||
1. Change the Pod Security Policy option to be unrestricted, then click **Save.**
|
||||
|
||||
### 2. Enable the CNI
|
||||
|
||||
When installing or upgrading Istio through **Apps & Marketplace,**
|
||||
|
||||
1. Click **Components.**
|
||||
2. Check the box next to **Enabled CNI.**
|
||||
3. Finish installing or upgrading Istio.
|
||||
|
||||
The CNI can also be enabled by editing the `values.yaml`:
|
||||
|
||||
```
|
||||
istio_cni.enabled: true
|
||||
```
|
||||
|
||||
Istio should install successfully with the CNI enabled in the cluster.
|
||||
|
||||
### 3. Verify that the CNI is working
|
||||
|
||||
Verify that the CNI is working by deploying a [sample application](https://istio.io/latest/docs/examples/bookinfo/) or deploying one of your own applications.
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="v2.5.0-v2.5.3">
|
||||
|
||||
> **Prerequisites:**
|
||||
>
|
||||
> - The cluster must be an RKE Kubernetes cluster.
|
||||
> - The cluster must have been created with a default PodSecurityPolicy.
|
||||
>
|
||||
> To enable pod security policy support when creating a Kubernetes cluster in the Rancher UI, go to <b>Advanced Options.</b> In the <b>Pod Security Policy Support</b> section, click <b>Enabled.</b> Then select a default pod security policy.
|
||||
|
||||
1. [Configure the System Project Policy to allow Istio install.](#1-configure-the-system-project-policy-to-allow-istio-install)
|
||||
2. [Install the CNI plugin in the System project.](#2-install-the-cni-plugin-in-the-system-project)
|
||||
3. [Install Istio.](#3-install-istio)
|
||||
|
||||
### 1. Configure the System Project Policy to allow Istio install
|
||||
|
||||
1. From the cluster view of the **Cluster Manager,** select **Projects/Namespaces.**
|
||||
1. Find the **Project: System** and select the **⋮ > Edit**.
|
||||
1. Change the Pod Security Policy option to be unrestricted, then click Save.
|
||||
|
||||
### 2. Install the CNI Plugin in the System Project
|
||||
|
||||
1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
|
||||
1. Select the **Project: System** project.
|
||||
1. Choose **Tools > Catalogs** in the navigation bar.
|
||||
1. Add a catalog with the following:
|
||||
1. Name: istio-cni
|
||||
1. Catalog URL: https://github.com/istio/cni
|
||||
1. Branch: The branch that matches your current release, for example: `release-1.4`.
|
||||
1. From the main menu select **Apps**
|
||||
1. Click Launch and select istio-cni
|
||||
1. Update the namespace to be "kube-system"
|
||||
1. In the answers section, click "Edit as YAML" and paste in the following, then click launch:
|
||||
|
||||
```
|
||||
---
|
||||
logLevel: "info"
|
||||
excludeNamespaces:
|
||||
- "istio-system"
|
||||
- "kube-system"
|
||||
```
|
||||
|
||||
### 3. Install Istio
|
||||
|
||||
Follow the [primary instructions]({{<baseurl>}}/rancher/v2.5/en/istio/setup/enable-istio-in-cluster/), adding a custom answer: `istio_cni.enabled: true`.
|
||||
|
||||
After Istio has finished installing, the Apps page in System Projects should show both istio and `istio-cni` applications deployed successfully. Sidecar injection will now be functional.
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
@@ -0,0 +1,38 @@
|
||||
---
|
||||
title: Additional Steps for Installing Istio on an RKE2 Cluster
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/rke2
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/rke2/
|
||||
---
|
||||
|
||||
Through the **Cluster Explorer,** when installing or upgrading Istio through **Apps & Marketplace,**
|
||||
|
||||
1. Click **Components.**
|
||||
1. Check the box next to **Enabled CNI.**
|
||||
1. Add a custom overlay file specifying `cniBinDir` and `cniConfDir`. For more information on these options, refer to the [Istio documentation.](https://istio.io/latest/docs/setup/additional-setup/cni/#helm-chart-parameters) An example is below:
|
||||
|
||||
```yaml
|
||||
apiVersion: install.istio.io/v1alpha1
|
||||
kind: IstioOperator
|
||||
spec:
|
||||
components:
|
||||
cni:
|
||||
enabled: true
|
||||
values:
|
||||
cni:
|
||||
image: rancher/istio-install-cni:1.7.3
|
||||
excludeNamespaces:
|
||||
- istio-system
|
||||
- kube-system
|
||||
logLevel: info
|
||||
cniBinDir: /opt/cni/bin
|
||||
cniConfDir: /etc/cni/net.d
|
||||
```
|
||||
1. After installing Istio, you'll notice the cni-node pods in the istio-system namespace in a CrashLoopBackoff error. Manually edit the `istio-cni-node` daemonset to include the following on the `install-cni` container:
|
||||
```yaml
|
||||
securityContext:
|
||||
privileged: true
|
||||
```
|
||||
|
||||
**Result:** Now you should be able to utilize Istio as desired, including sidecar injection and monitoring via Kiali.
|
||||
+130
@@ -0,0 +1,130 @@
|
||||
---
|
||||
title: Selectors and Scrape Configs
|
||||
weight: 2
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/configuration-reference/selectors-and-scrape
|
||||
- /rancher/v2.5/en/istio/setup/node-selectors
|
||||
- /rancher/v2.x/en/istio/v2.5/configuration-reference/selectors-and-scrape/
|
||||
---
|
||||
|
||||
The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=false`, which enables monitoring across all namespaces by default.
|
||||
|
||||
This ensures you can view traffic, metrics and graphs for resources deployed in a namespace with `istio-injection=enabled` label.
|
||||
|
||||
If you would like to limit Prometheus to specific namespaces, set `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`. Once you do this, you will need to add additional configuration to continue to monitor your resources.
|
||||
|
||||
- [Limiting Monitoring to Specific Namespaces by Setting ignoreNamespaceSelectors to True](#limiting-monitoring-to-specific-namespaces-by-setting-ignorenamespaceselectors-to-true)
|
||||
- [Enabling Prometheus to Detect Resources in Other Namespaces](#enabling-prometheus-to-detect-resources-in-other-namespaces)
|
||||
- [Monitoring Specific Namespaces: Create a Service Monitor or Pod Monitor](#monitoring-specific-namespaces-create-a-service-monitor-or-pod-monitor)
|
||||
- [Monitoring Across Namespaces: Set ignoreNamespaceSelectors to False](#monitoring-across-namespaces-set-ignorenamespaceselectors-to-false)
|
||||
|
||||
### Limiting Monitoring to Specific Namespaces by Setting ignoreNamespaceSelectors to True
|
||||
|
||||
This limits monitoring to specific namespaces.
|
||||
|
||||
1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace**
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true`
|
||||
1. Complete install or upgrade
|
||||
|
||||
**Result:** Prometheus will be limited to specific namespaces which means one of the following configurations will need to be set up to continue to view data in various dashboards
|
||||
|
||||
### Enabling Prometheus to Detect Resources in Other Namespaces
|
||||
|
||||
There are two different ways to enable Prometheus to detect resources in other namespaces when `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`:
|
||||
|
||||
- **Monitoring specific namespaces:** Add a Service Monitor or Pod Monitor in the namespace with the targets you want to scrape.
|
||||
- **Monitoring across namespaces:** Add an `additionalScrapeConfig` to your rancher-monitoring instance to scrape all targets in all namespaces.
|
||||
|
||||
### Monitoring Specific Namespaces: Create a Service Monitor or Pod Monitor
|
||||
|
||||
This option allows you to define which specific services or pods you would like monitored in a specific namespace.
|
||||
|
||||
The usability tradeoff is that you have to create the service monitor or pod monitor per namespace since you cannot monitor across namespaces.
|
||||
|
||||
> **Prerequisite:** Define a ServiceMonitor or PodMonitor for `<your namespace>`. An example ServiceMonitor is provided below.
|
||||
|
||||
1. From the **Cluster Explorer**, open the kubectl shell
|
||||
1. Run `kubectl create -f <name of service/pod monitor file>.yaml` if the file is stored locally in your cluster.
|
||||
1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command.
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart and scroll down to **Preview Yaml**.
|
||||
1. Run `kubectl label namespace <your namespace> istio-injection=enabled` to enable the envoy sidecar injection
|
||||
|
||||
**Result:** `<your namespace>` can be scraped by prometheus.
|
||||
|
||||
<figcaption>Example Service Monitor for Istio Proxies</figcaption>
|
||||
|
||||
```yaml
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: envoy-stats-monitor
|
||||
namespace: istio-system
|
||||
labels:
|
||||
monitoring: istio-proxies
|
||||
spec:
|
||||
selector:
|
||||
matchExpressions:
|
||||
- {key: istio-prometheus-ignore, operator: DoesNotExist}
|
||||
namespaceSelector:
|
||||
any: true
|
||||
jobLabel: envoy-stats
|
||||
endpoints:
|
||||
- path: /stats/prometheus
|
||||
targetPort: 15090
|
||||
interval: 15s
|
||||
relabelings:
|
||||
- sourceLabels: [__meta_kubernetes_pod_container_port_name]
|
||||
action: keep
|
||||
regex: '.*-envoy-prom'
|
||||
- action: labeldrop
|
||||
regex: "__meta_kubernetes_pod_label_(.+)"
|
||||
- sourceLabels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
targetLabel: namespace
|
||||
- sourceLabels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
targetLabel: pod_name
|
||||
```
|
||||
|
||||
### Monitoring across namespaces: Set ignoreNamespaceSelectors to False
|
||||
|
||||
This enables monitoring across namespaces by giving Prometheus additional scrape configurations.
|
||||
|
||||
The usability tradeoff is that all of Prometheus' `additionalScrapeConfigs` are maintained in a single Secret. This could make upgrading difficult if monitoring is already deployed with additionalScrapeConfigs before installing Istio.
|
||||
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade** and then **Preview Yaml**.
|
||||
1. Set`prometheus.prometheusSpec.additionalScrapeConfigs` array to the **Additional Scrape Config** provided below.
|
||||
1. Complete install or upgrade
|
||||
|
||||
**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
|
||||
|
||||
<figcaption>Additional Scrape Config</figcaption>
|
||||
|
||||
``` yaml
|
||||
- job_name: 'istio/envoy-stats'
|
||||
scrape_interval: 15s
|
||||
metrics_path: /stats/prometheus
|
||||
kubernetes_sd_configs:
|
||||
- role: pod
|
||||
relabel_configs:
|
||||
- source_labels: [__meta_kubernetes_pod_container_port_name]
|
||||
action: keep
|
||||
regex: '.*-envoy-prom'
|
||||
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
||||
action: replace
|
||||
regex: ([^:]+)(?::\d+)?;(\d+)
|
||||
replacement: $1:15090
|
||||
target_label: __address__
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_pod_label_(.+)
|
||||
- source_labels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
target_label: namespace
|
||||
- source_labels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
target_label: pod_name
|
||||
```
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
title: Disabling Istio
|
||||
weight: 4
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/v2.5/disabling-istio
|
||||
- /rancher/v2.x/en/istio/v2.5/disabling-istio/
|
||||
---
|
||||
|
||||
This section describes how to uninstall Istio in a cluster or disable a namespace, or workload.
|
||||
|
||||
# Uninstall Istio in a Cluster
|
||||
|
||||
To uninstall Istio,
|
||||
|
||||
1. From the **Cluster Explorer,** navigate to **Installed Apps** in **Apps & Marketplace** and locate the `rancher-istio` installation.
|
||||
1. Select `rancher-istio` in the `istio-system namespace and click **Delete**
|
||||
1. After `rancher-istio` is deleted, you can then select all the remaining apps in the `istio-system` namespace and click **Delete**
|
||||
|
||||
**Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster.
|
||||
|
||||
**Note:** You can no longer disable and re-enable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations.
|
||||
|
||||
**Troubleshooting Uninstall:** If you didn't follow the uninstall steps, you may encounter a warning during uninstall:
|
||||
|
||||
`Error: uninstallation completed with 1 error(s): unable to build kubernetes objects for delete: unable to recognize "": no matches for kind "MonitoringDashboard" in version "monitoring.kiali.io/v1alpha1"`
|
||||
|
||||
This could mean a few things. You either selected all the apps in the `istio-system` namespace and deleted them at the same time, or you deleted `rancher-istio` chart dependencies prior to deleting the `rancher-istio` chart. Since the uninstall did not complete properly, you will have resources remaining in the `istio-system` namespace that you will need to manually clean up. Another option to avoid manual clean up is to install `rancher-istio` again, then uninstall it in the correct order.
|
||||
|
||||
# Disable Istio in a Namespace
|
||||
|
||||
1. From the **Cluster Explorer** view, use the side-nav to select **Namespaces** page
|
||||
1. On the **Namespace** page, you will see a list of namespaces. Go to the namespace where you want to disable and click the select **Edit as Form** or **Edit as Yaml**
|
||||
1. Remove the `istio-injection=enabled` label from the namespace
|
||||
1. Click **Save**
|
||||
|
||||
**Result:** When workloads are deployed in this namespace, they will not have the Istio sidecar.
|
||||
|
||||
# Remove the Istio Sidecar from a Workload
|
||||
|
||||
Disable Istio in the namespace, then redeploy the workloads with in it. They will be deployed without the Istio sidecar.
|
||||
@@ -0,0 +1,128 @@
|
||||
---
|
||||
title: Istio
|
||||
weight: 14
|
||||
aliases:
|
||||
- /rancher/v2.5/en/dashboard/istio
|
||||
- /rancher/v2.x/en/istio/
|
||||
- /rancher/v2.x/en/istio/v2.5/
|
||||
---
|
||||
|
||||
[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices.
|
||||
|
||||
As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
|
||||
|
||||
Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to a team of developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
|
||||
|
||||
This core service mesh provides features that include but are not limited to the following:
|
||||
|
||||
- **Traffic Management** such as ingress and egress routing, circuit breaking, mirroring.
|
||||
- **Security** with resources to authenticate and authorize traffic and users, mTLS included.
|
||||
- **Observability** of logs, metrics, and distributed traffic flows.
|
||||
|
||||
After [setting up istio]({{<baseurl>}}/rancher/v2.5/en/istio/setup) you can leverage Istio's control plane functionality through the Cluster Explorer, `kubectl`, or `istioctl`.
|
||||
|
||||
Istio needs to be set up by a `cluster-admin` before it can be used in a project.
|
||||
|
||||
- [What's New in Rancher v2.5](#what-s-new-in-rancher-v2-5)
|
||||
- [Tools Bundled with Istio](#tools-bundled-with-istio)
|
||||
- [Prerequisites](#prerequisites)
|
||||
- [Setup Guide](#setup-guide)
|
||||
- [Remove Istio](#remove-istio)
|
||||
- [Migrate from Previous Istio Version](#migrate-from-previous-istio-version)
|
||||
- [Accessing Visualizations](#accessing-visualizations)
|
||||
- [Architecture](#architecture)
|
||||
- [Additional steps for installing Istio on an RKE2 cluster](#additional-steps-for-installing-istio-on-an-rke2-cluster)
|
||||
|
||||
# What's New in Rancher v2.5
|
||||
|
||||
The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
|
||||
|
||||
Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
|
||||
|
||||
A Prometheus integration will still be available through an installation of [Rancher Monitoring]({{<baseurl>}}/rancher/v2.5/en/monitoring-alerting/), or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
|
||||
|
||||
Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
|
||||
|
||||
This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
|
||||
|
||||
# Tools Bundled with Istio
|
||||
|
||||
Our [Istio](https://istio.io/) installer wraps the istioctl binary commands in a handy Helm chart, including an overlay file option to allow complex customization.
|
||||
|
||||
It also includes the following:
|
||||
|
||||
### Kiali
|
||||
|
||||
Kiali is a comprehensive visualization aid used for graphing traffic flow throughout the service mesh. It allows you to see how they are connected, including the traffic rates and latencies between them.
|
||||
|
||||
You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
|
||||
|
||||
### Jaeger
|
||||
|
||||
_Bundled as of v2.5.4_
|
||||
|
||||
Our Istio installer includes a quick-start, all-in-one installation of [Jaeger,](https://www.jaegertracing.io/) a tool used for tracing distributed systems.
|
||||
|
||||
Note that this is not a production-qualified deployment of Jaeger. This deployment uses an in-memory storage component, while a persistent storage component is recommended for production. For more information on which deployment strategy you may need, refer to the [Jaeger documentation.](https://www.jaegertracing.io/docs/latest/operator/#production-strategy)
|
||||
|
||||
# Prerequisites
|
||||
|
||||
Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.5/en/istio/resources) to run all of the components of Istio.
|
||||
|
||||
If you are installing Istio on RKE2 cluster, some additional steps are required. For details, see [this section.](#additional-steps-for-installing-istio-on-an-rke2-cluster)
|
||||
|
||||
# Setup Guide
|
||||
|
||||
Refer to the [setup guide]({{<baseurl>}}/rancher/v2.5/en/istio/setup) for instructions on how to set up Istio and use it in a project.
|
||||
|
||||
# Remove Istio
|
||||
|
||||
To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.5/en/istio/disabling-istio/)
|
||||
|
||||
# Migrate From Previous Istio Version
|
||||
|
||||
There is no upgrade path for Istio versions less than 1.7.x. To successfully install Istio in the **Cluster Explorer**, you will need to disable your existing Istio in the **Cluster Manager**.
|
||||
|
||||
If you have a significant amount of additional Istio CRDs you might consider manually migrating CRDs that are supported in both versions of Istio. You can do this by running `kubectl get <resource> -n istio-system -o yaml`, save the output yaml and re-apply in the new version.
|
||||
|
||||
Another option is to manually uninstall istio resources one at a time, but leave the resources that are supported in both versions of Istio and that will not be installed by the newest version. This method is more likely to result in issues installing the new version, but could be a good option depending on your situation.
|
||||
|
||||
# Accessing Visualizations
|
||||
|
||||
> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, see [this section.]({{<baseurl>}}/rancher/v2.5/en/istio/rbac/)
|
||||
|
||||
After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI.
|
||||
|
||||
To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus**
|
||||
|
||||
To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics.
|
||||
|
||||
By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup](./configuration-reference/selectors-and-scrape) if you would like to use a different configuration for prometheus data scraping.
|
||||
|
||||
Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
|
||||
|
||||
# Architecture
|
||||
|
||||
Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
|
||||
|
||||
Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
|
||||
|
||||
When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
|
||||
|
||||
For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/)
|
||||
|
||||
### Multiple Ingresses
|
||||
|
||||
By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace. The result is that your cluster will have two ingresses in your cluster.
|
||||
|
||||
|
||||
|
||||
Additional Istio Ingress gateways can be enabled via the [overlay file]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/#overlay-file).
|
||||
|
||||
### Egress Support
|
||||
|
||||
By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/#overlay-file).
|
||||
|
||||
# Additional Steps for Installing Istio on an RKE2 Cluster
|
||||
|
||||
To install Istio on an RKE2 cluster, follow the steps in [this section.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/rke2/)
|
||||
@@ -0,0 +1,48 @@
|
||||
---
|
||||
title: Role-based Access Control
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/rbac
|
||||
- /rancher/v2.5/en/istio/v2.5/rbac
|
||||
- /rancher/v2.x/en/istio/v2.5/rbac/
|
||||
---
|
||||
|
||||
This section describes the permissions required to access Istio features.
|
||||
|
||||
The rancher istio chart installs three `ClusterRoles`
|
||||
|
||||
## Cluster-Admin Access
|
||||
|
||||
By default, only those with the `cluster-admin` `ClusterRole` can:
|
||||
|
||||
- Install istio app in a cluster
|
||||
- Configure resource allocations for Istio
|
||||
|
||||
|
||||
## Admin and Edit access
|
||||
|
||||
By default, only Admin and Edit roles can:
|
||||
|
||||
- Enable and disable Istio sidecar auto-injection for namespaces
|
||||
- Add the Istio sidecar to workloads
|
||||
- View the traffic metrics and traffic graph for the cluster
|
||||
- Configure Istio's resources (such as the gateway, destination rules, or virtual services)
|
||||
|
||||
## Summary of Default Permissions for Kubernetes Default roles
|
||||
|
||||
Istio creates three `ClusterRoles` and adds Istio CRD access to the following default K8s `ClusterRole`:
|
||||
|
||||
ClusterRole create by chart | Default K8s ClusterRole | Rancher Role |
|
||||
------------------------------:| ---------------------------:|---------:|
|
||||
`istio-admin` | admin| Project Owner |
|
||||
`istio-edit`| edit | Project Member |
|
||||
`istio-view` | view | Read-only |
|
||||
|
||||
Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create ( C ), Get ( G ), List ( L ), Watch ( W ), Update ( U ), Patch ( P ), Delete( D ), All ( * )) that can be performed.
|
||||
|
||||
|
||||
|CRDs | Admin | Edit | View
|
||||
|----------------------------| ------| -----| -----
|
||||
| <ul><li>`config.istio.io`</li><ul><li>`adapters`</li><li>`attributemanifests`</li><li>`handlers`</li><li>`httpapispecbindings`</li><li>`httpapispecs`</li><li>`instances`</li><li>`quotaspecbindings`</li><li>`quotaspecs`</li><li>`rules`</li><li>`templates`</li></ul></ul>| GLW | GLW | GLW
|
||||
|<ul><li>`networking.istio.io`</li><ul><li>`destinationrules`</li><li>`envoyfilters`</li><li>`gateways`</li><li>`serviceentries`</li><li>`sidecars`</li><li>`virtualservices`</li><li>`workloadentries`</li></ul></ul>| * | * | GLW
|
||||
|<ul><li>`security.istio.io`</li><ul><li>`authorizationpolicies`</li><li>`peerauthentications`</li><li>`requestauthentications`</li></ul></ul>| * | * | GLW
|
||||
@@ -0,0 +1,82 @@
|
||||
---
|
||||
title: CPU and Memory Allocations
|
||||
weight: 1
|
||||
aliases:
|
||||
- /rancher/v2.5/en/project-admin/istio/configuring-resource-allocations/
|
||||
- /rancher/v2.5/en/project-admin/istio/config/
|
||||
- /rancher/v2.5/en/istio/resources
|
||||
- /rancher/v2.5/en/istio/v2.5/resources
|
||||
- /rancher/v2.x/en/istio/v2.5/resources/
|
||||
---
|
||||
|
||||
import Tabs from '@theme/Tabs';
|
||||
import TabItem from '@theme/TabItem';
|
||||
|
||||
This section describes the minimum recommended computing resources for the Istio components in a cluster.
|
||||
|
||||
The CPU and memory allocations for each component are [configurable.](#configuring-resource-allocations)
|
||||
|
||||
Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough CPU and memory to run all of the components of Istio.
|
||||
|
||||
> **Tip:** In larger deployments, it is strongly advised that the infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
|
||||
|
||||
The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each core Istio component.
|
||||
|
||||
In Kubernetes, the resource request indicates that the workload will not be deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
|
||||
|
||||
<Tabs>
|
||||
<TabItem value="v2.5.6+">
|
||||
|
||||
| Workload | CPU - Request | Memory - Request | CPU - Limit | Memory - Limit |
|
||||
|----------------------|---------------|------------|-----------------|-------------------|
|
||||
| ingress gateway | 100m | 128mi | 2000m | 1024mi |
|
||||
| egress gateway | 100m | 128mi | 2000m | 1024mi |
|
||||
| istiod | 500m | 2048mi | No limit | No limit |
|
||||
| proxy | 10m | 10mi | 2000m | 1024mi |
|
||||
| **Totals:** | **710m** | **2314Mi** | **6000m** | **3072Mi** |
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="v2.5.0-v2.5.5">
|
||||
|
||||
Workload | CPU - Request | Memory - Request | CPU - Limit | Mem - Limit | Configurable
|
||||
---------:|---------------:|---------------:|-------------:|-------------:|-------------:
|
||||
Istiod | 500m | 2048Mi | No limit | No limit | Y |
|
||||
Istio-Mixer | 1000m | 1000Mi | 4800m | 4000Mi | Y |
|
||||
Istio-ingressgateway | 100m | 128Mi | 2000m | 1024Mi | Y |
|
||||
Others | 10m | - | - | - | Y |
|
||||
Totals: | 1710m | 3304Mi | >8800m | >6048Mi | -
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
# Configuring Resource Allocations
|
||||
|
||||
You can individually configure the resource allocation for each type of Istio component. This section includes the default resource allocations for each component.
|
||||
|
||||
To make it easier to schedule the workloads to a node, a cluster-admin can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
|
||||
|
||||
You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/).
|
||||
|
||||
To configure the resources allocated to an Istio component,
|
||||
|
||||
1. In the Rancher **Cluster Explorer**, navigate to your Istio installation in **Apps & Marketplace**
|
||||
1. Click **Upgrade** to edit the base components via changes to the values.yaml or add an [overlay file]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/#overlay-file). For more information about editing the overlay file, see [this section.](./#editing-the-overlay-file)
|
||||
1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
|
||||
1. Click **Upgrade.** to rollout changes
|
||||
|
||||
**Result:** The resource allocations for the Istio components are updated.
|
||||
|
||||
### Editing the Overlay File
|
||||
|
||||
The overlay file can contain any of the values in the [Istio Operator spec.](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#IstioOperatorSpec) The overlay file included with the Istio application is just one example of a potential configuration of the overlay file.
|
||||
|
||||
As long as the file contains `kind: IstioOperator` and the YAML options are valid, the file can be used as an overlay.
|
||||
|
||||
In the example overlay file provided with the Istio application, the following section allows you to change Kubernetes resources:
|
||||
|
||||
```
|
||||
# k8s:
|
||||
# resources:
|
||||
# requests:
|
||||
# cpu: 200m
|
||||
```
|
||||
@@ -0,0 +1,351 @@
|
||||
---
|
||||
title: 3. Add Deployments and Services with the Istio Sidecar
|
||||
weight: 4
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/deploy-workloads
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/deploy-workloads
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/deploy-workloads/
|
||||
---
|
||||
|
||||
> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have the Istio app installed.
|
||||
|
||||
Enabling Istio in a namespace only enables automatic sidecar injection for new workloads. To enable the Envoy sidecar for existing workloads, you need to enable it manually for each workload.
|
||||
|
||||
To inject the Istio sidecar on an existing workload in the namespace, from the **Cluster Explorer** go to the workload, click the **⋮,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
|
||||
|
||||
Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see `istio-proxy` alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
|
||||
|
||||
### Add Deployments and Services
|
||||
|
||||
There are a few ways to add new **Deployments** in your namespace
|
||||
|
||||
1. From the **Cluster Explorer** click on **Workload > Overview.**
|
||||
1. Click **Create.**
|
||||
1. Select **Deployment** from the various workload options.
|
||||
1. Fill out the form, or **Edit as Yaml.**
|
||||
1. Click **Create.**
|
||||
|
||||
Alternatively, you can select the specific workload you want to deploy from the **Workload** section of the left navigation bar and create it from there.
|
||||
|
||||
To add a **Service** to your namespace
|
||||
|
||||
1. From the **Cluster Explorer** click on **Service Discovery > Services**
|
||||
1. Click **Create**
|
||||
1. Select the type of service you want to create from the various options
|
||||
1. Fill out the form, or **Edit as Yaml**
|
||||
1. Click **Create**
|
||||
|
||||
You can also create deployments and services using the kubectl **shell**
|
||||
|
||||
1. Run `kubectl create -f <name of service/deployment file>.yaml` if your file is stored locally in the cluster
|
||||
1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command.
|
||||
|
||||
### Example Deployments and Services
|
||||
|
||||
Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation.
|
||||
|
||||
1. From the **Cluster Explorer**, open the kubectl **shell**
|
||||
1. Run `cat<< EOF | kubectl apply -f -`
|
||||
1. Copy the below resources into the the shell
|
||||
1. Run `EOF`
|
||||
|
||||
This will set up the following sample resources from Istio's example BookInfo app:
|
||||
|
||||
Details service and deployment:
|
||||
|
||||
- A `details` Service
|
||||
- A ServiceAccount for `bookinfo-details`
|
||||
- A `details-v1` Deployment
|
||||
|
||||
Ratings service and deployment:
|
||||
|
||||
- A `ratings` Service
|
||||
- A ServiceAccount for `bookinfo-ratings`
|
||||
- A `ratings-v1` Deployment
|
||||
|
||||
Reviews service and deployments (three versions):
|
||||
|
||||
- A `reviews` Service
|
||||
- A ServiceAccount for `bookinfo-reviews`
|
||||
- A `reviews-v1` Deployment
|
||||
- A `reviews-v2` Deployment
|
||||
- A `reviews-v3` Deployment
|
||||
|
||||
Productpage service and deployment:
|
||||
|
||||
This is the main page of the app, which will be visible from a web browser. The other services will be called from this page.
|
||||
|
||||
- A `productpage` service
|
||||
- A ServiceAccount for `bookinfo-productpage`
|
||||
- A `productpage-v1` Deployment
|
||||
|
||||
### Resource YAML
|
||||
|
||||
```yaml
|
||||
# Copyright 2017 Istio Authors
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
##################################################################################################
|
||||
# Details service
|
||||
##################################################################################################
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: details
|
||||
labels:
|
||||
app: details
|
||||
service: details
|
||||
spec:
|
||||
ports:
|
||||
- port: 9080
|
||||
name: http
|
||||
selector:
|
||||
app: details
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: bookinfo-details
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: details-v1
|
||||
labels:
|
||||
app: details
|
||||
version: v1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: details
|
||||
version: v1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: details
|
||||
version: v1
|
||||
spec:
|
||||
serviceAccountName: bookinfo-details
|
||||
containers:
|
||||
- name: details
|
||||
image: docker.io/istio/examples-bookinfo-details-v1:1.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 9080
|
||||
---
|
||||
##################################################################################################
|
||||
# Ratings service
|
||||
##################################################################################################
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ratings
|
||||
labels:
|
||||
app: ratings
|
||||
service: ratings
|
||||
spec:
|
||||
ports:
|
||||
- port: 9080
|
||||
name: http
|
||||
selector:
|
||||
app: ratings
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: bookinfo-ratings
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ratings-v1
|
||||
labels:
|
||||
app: ratings
|
||||
version: v1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ratings
|
||||
version: v1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ratings
|
||||
version: v1
|
||||
spec:
|
||||
serviceAccountName: bookinfo-ratings
|
||||
containers:
|
||||
- name: ratings
|
||||
image: docker.io/istio/examples-bookinfo-ratings-v1:1.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 9080
|
||||
---
|
||||
##################################################################################################
|
||||
# Reviews service
|
||||
##################################################################################################
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: reviews
|
||||
labels:
|
||||
app: reviews
|
||||
service: reviews
|
||||
spec:
|
||||
ports:
|
||||
- port: 9080
|
||||
name: http
|
||||
selector:
|
||||
app: reviews
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: bookinfo-reviews
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: reviews-v1
|
||||
labels:
|
||||
app: reviews
|
||||
version: v1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: reviews
|
||||
version: v1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: reviews
|
||||
version: v1
|
||||
spec:
|
||||
serviceAccountName: bookinfo-reviews
|
||||
containers:
|
||||
- name: reviews
|
||||
image: docker.io/istio/examples-bookinfo-reviews-v1:1.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 9080
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: reviews-v2
|
||||
labels:
|
||||
app: reviews
|
||||
version: v2
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: reviews
|
||||
version: v2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: reviews
|
||||
version: v2
|
||||
spec:
|
||||
serviceAccountName: bookinfo-reviews
|
||||
containers:
|
||||
- name: reviews
|
||||
image: docker.io/istio/examples-bookinfo-reviews-v2:1.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 9080
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: reviews-v3
|
||||
labels:
|
||||
app: reviews
|
||||
version: v3
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: reviews
|
||||
version: v3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: reviews
|
||||
version: v3
|
||||
spec:
|
||||
serviceAccountName: bookinfo-reviews
|
||||
containers:
|
||||
- name: reviews
|
||||
image: docker.io/istio/examples-bookinfo-reviews-v3:1.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 9080
|
||||
---
|
||||
##################################################################################################
|
||||
# Productpage services
|
||||
##################################################################################################
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: productpage
|
||||
labels:
|
||||
app: productpage
|
||||
service: productpage
|
||||
spec:
|
||||
ports:
|
||||
- port: 9080
|
||||
name: http
|
||||
selector:
|
||||
app: productpage
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: bookinfo-productpage
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: productpage-v1
|
||||
labels:
|
||||
app: productpage
|
||||
version: v1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: productpage
|
||||
version: v1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: productpage
|
||||
version: v1
|
||||
spec:
|
||||
serviceAccountName: bookinfo-productpage
|
||||
containers:
|
||||
- name: productpage
|
||||
image: docker.io/istio/examples-bookinfo-productpage-v1:1.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 9080
|
||||
---
|
||||
```
|
||||
|
||||
### [Next: Set up the Istio Gateway]({{<baseurl>}}/rancher/v2.5/en/istio/setup/gateway)
|
||||
+29
@@ -0,0 +1,29 @@
|
||||
---
|
||||
title: 1. Enable Istio in the Cluster
|
||||
weight: 1
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/enable-istio-in-cluster
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/enable-istio-in-cluster
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/
|
||||
---
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
>- Only a user with the `cluster-admin` [Kubernetes default role](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster.
|
||||
>- If you have pod security policies, you will need to install Istio with the CNI enabled. For details, see [this section.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/enable-istio-with-psp)
|
||||
>- To install Istio on an RKE2 cluster, additional steps are required. For details, see [this section.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/rke2/)
|
||||
>- To install Istio in a cluster where project network isolation is enabled, additional steps are required. For details, see [this section.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/canal-and-project-network)
|
||||
|
||||
1. From the **Cluster Explorer**, navigate to available **Charts** in **Apps & Marketplace**
|
||||
1. Select the Istio chart from the rancher provided charts
|
||||
1. If you have not already installed your own monitoring app, you will be prompted to install the rancher-monitoring app. Optional: Set your Selector or Scrape config options on rancher-monitoring app install.
|
||||
1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.5/en/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
|
||||
1. Optional: Make additional configuration changes to values.yaml if needed.
|
||||
1. Optional: Add additional resources or configuration via the [overlay file.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/#overlay-file)
|
||||
1. Click **Install**.
|
||||
|
||||
**Result:** Istio is installed at the cluster level.
|
||||
|
||||
# Additional Config Options
|
||||
|
||||
For more information on configuring Istio, refer to the [configuration reference.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference)
|
||||
+45
@@ -0,0 +1,45 @@
|
||||
---
|
||||
title: 2. Enable Istio in a Namespace
|
||||
weight: 2
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/enable-istio-in-namespace
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/enable-istio-in-namespace
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-namespace/
|
||||
---
|
||||
|
||||
You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace.
|
||||
|
||||
This namespace setting will only affect new workloads in the namespace. Any preexisting workloads will need to be re-deployed to leverage the sidecar auto injection.
|
||||
|
||||
> **Prerequisite:** To enable Istio in a namespace, the cluster must have Istio installed.
|
||||
|
||||
1. In the Rancher **Cluster Explorer,** open the kubectl shell.
|
||||
1. Then run `kubectl label namespace <namespace> istio-injection=enabled`
|
||||
|
||||
**Result:** The namespace now has the label `istio-injection=enabled`. All new workloads deployed in this namespace will have the Istio sidecar injected by default.
|
||||
|
||||
### Verifying that Automatic Istio Sidecar Injection is Enabled
|
||||
|
||||
To verify that Istio is enabled, deploy a hello-world workload in the namespace. Go to the workload and click the pod name. In the **Containers** section, you should see the `istio-proxy` container.
|
||||
|
||||
### Excluding Workloads from Being Injected with the Istio Sidecar
|
||||
|
||||
If you need to exclude a workload from getting injected with the Istio sidecar, use the following annotation on the workload:
|
||||
|
||||
```
|
||||
sidecar.istio.io/inject: “false”
|
||||
```
|
||||
|
||||
To add the annotation to a workload,
|
||||
|
||||
1. From the **Cluster Explorer** view, use the side-nav to select the **Overview** page for workloads.
|
||||
1. Go to the workload that should not have the sidecar and edit as yaml
|
||||
1. Add the following key, value `sidecar.istio.io/inject: false` as an annotation on the workload
|
||||
1. Click **Save.**
|
||||
|
||||
**Result:** The Istio sidecar will not be injected into the workload.
|
||||
|
||||
> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed.
|
||||
|
||||
|
||||
### [Next: Select the Nodes ]({{<baseurl>}}/rancher/v2.5/en/istio/setup/node-selectors)
|
||||
@@ -0,0 +1,144 @@
|
||||
---
|
||||
title: 4. Set up the Istio Gateway
|
||||
weight: 5
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/gateway
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/gateway
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/gateway/
|
||||
---
|
||||
|
||||
The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster.
|
||||
|
||||
You can use the Nginx Ingress controller with or without Istio installed. If this is the only gateway to your cluster, Istio will be able to route traffic from service to service, but Istio will not be able to receive traffic from outside the cluster.
|
||||
|
||||
To allow Istio to receive external traffic, you need to enable Istio's gateway, which works as a north-south proxy for external traffic. When you enable the Istio gateway, the result is that your cluster will have two Ingresses.
|
||||
|
||||
You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
|
||||
|
||||
You can route traffic into the service mesh with a load balancer or use Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
|
||||
|
||||
For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/)
|
||||
|
||||
|
||||
|
||||
# Enable an Istio Gateway
|
||||
|
||||
The ingress gateway is a Kubernetes service that will be deployed in your cluster. The Istio Gateway allows for more extensive customization and flexibility.
|
||||
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click **Gateways** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Paste your Istio Gateway yaml, or **Read from File**.
|
||||
1. Click **Create**.
|
||||
|
||||
**Result:** The gateway is deployed, and will now route traffic with applied rules
|
||||
|
||||
# Example Istio Gateway
|
||||
|
||||
We add the BookInfo app deployments in services when going through the Workloads example. Next we add an Istio Gateway so that the app is accessible from outside your cluster.
|
||||
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click **Gateways** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the Gateway yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: bookinfo-gateway
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway # use istio default controller
|
||||
servers:
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "*"
|
||||
---
|
||||
```
|
||||
|
||||
Then to deploy the VirtualService that provides the traffic routing for the Gateway
|
||||
|
||||
1. Click **VirtualService** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the VirtualService yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: bookinfo
|
||||
spec:
|
||||
hosts:
|
||||
- "*"
|
||||
gateways:
|
||||
- bookinfo-gateway
|
||||
http:
|
||||
- match:
|
||||
- uri:
|
||||
exact: /productpage
|
||||
- uri:
|
||||
prefix: /static
|
||||
- uri:
|
||||
exact: /login
|
||||
- uri:
|
||||
exact: /logout
|
||||
- uri:
|
||||
prefix: /api/v1/products
|
||||
route:
|
||||
- destination:
|
||||
host: productpage
|
||||
port:
|
||||
number: 9080
|
||||
```
|
||||
|
||||
**Result:** You have configured your gateway resource so that Istio can receive traffic from outside the cluster.
|
||||
|
||||
Confirm that the resource exists by running:
|
||||
```
|
||||
kubectl get gateway -A
|
||||
```
|
||||
|
||||
The result should be something like this:
|
||||
```
|
||||
NAME AGE
|
||||
bookinfo-gateway 64m
|
||||
```
|
||||
|
||||
### Access the ProductPage Service from a Web Browser
|
||||
|
||||
To test and see if the BookInfo app deployed correctly, the app can be viewed a web browser using the Istio controller IP and port, combined with the request name specified in your Kubernetes gateway resource:
|
||||
|
||||
`http://<IP of Istio controller>:<Port of istio controller>/productpage`
|
||||
|
||||
To get the ingress gateway URL and port,
|
||||
|
||||
1. From the **Cluster Explorer**, Click on **Workloads > Overview**.
|
||||
1. Scroll down to the `istio-system` namespace.
|
||||
1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Under the name of this workload, you should see links, such as `80/tcp`.
|
||||
1. Click one of those links. This should show you the URL of the ingress gateway in your web browser. Append `/productpage` to the URL.
|
||||
|
||||
**Result:** You should see the BookInfo app in the web browser.
|
||||
|
||||
For help inspecting the Istio controller URL and ports, try the commands the [Istio documentation.](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#determining-the-ingress-ip-and-ports)
|
||||
|
||||
# Troubleshooting
|
||||
|
||||
The [official Istio documentation](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#troubleshooting) suggests `kubectl` commands to inspect the correct ingress host and ingress port for external requests.
|
||||
|
||||
### Confirming that the Kubernetes Gateway Matches Istio's Ingress Controller
|
||||
|
||||
You can try the steps in this section to make sure the Kubernetes gateway is configured properly.
|
||||
|
||||
In the gateway resource, the selector refers to Istio's default ingress controller by its label, in which the key of the label is `istio` and the value is `ingressgateway`. To make sure the label is appropriate for the gateway, do the following:
|
||||
|
||||
1. From the **Cluster Explorer**, Click on **Workloads > Overview**.
|
||||
1. Scroll down to the `istio-system` namespace.
|
||||
1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
|
||||
|
||||
### [Next: Set up Istio's Components for Traffic Management]({{<baseurl>}}/rancher/v2.5/en/istio/setup/set-up-traffic-management)
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
---
|
||||
title: 5. Set up Istio's Components for Traffic Management
|
||||
weight: 6
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/set-up-traffic-management
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/set-up-traffic-management
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/set-up-traffic-management/
|
||||
---
|
||||
|
||||
A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*.
|
||||
|
||||
- [Virtual services](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/) intercept and direct traffic to your Kubernetes services, allowing you to divide percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed.
|
||||
- [Destination rules](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/) serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred.
|
||||
|
||||
This section describes how to add an example virtual service that corresponds to the `reviews` microservice in the sample BookInfo app. The purpose of this service is to divide traffic between two versions of the `reviews` service.
|
||||
|
||||
In this example, we take the traffic to the `reviews` service and intercept it so that 50 percent of it goes to `v1` of the service and 50 percent goes to `v2`.
|
||||
|
||||
After this virtual service is deployed, we will generate traffic and see from the Kiali visualization that traffic is being routed evenly between the two versions of the service.
|
||||
|
||||
To deploy the virtual service and destination rules for the `reviews` service,
|
||||
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click **DestinationRule** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the DestinationRule yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: DestinationRule
|
||||
metadata:
|
||||
name: reviews
|
||||
spec:
|
||||
host: reviews
|
||||
subsets:
|
||||
- name: v1
|
||||
labels:
|
||||
version: v1
|
||||
- name: v2
|
||||
labels:
|
||||
version: v2
|
||||
- name: v3
|
||||
labels:
|
||||
version: v3
|
||||
```
|
||||
|
||||
Then to deploy the VirtualService that provides the traffic routing that utilizes the DestinationRule
|
||||
|
||||
1. Click **VirtualService** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the VirtualService yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: reviews
|
||||
spec:
|
||||
hosts:
|
||||
- reviews
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: reviews
|
||||
subset: v1
|
||||
weight: 50
|
||||
- destination:
|
||||
host: reviews
|
||||
subset: v3
|
||||
weight: 50
|
||||
---
|
||||
```
|
||||
|
||||
**Result:** When you generate traffic to this service (for example, by refreshing the ingress gateway URL), the Kiali traffic graph will reflect that traffic to the `reviews` service is divided evenly between `v1` and `v3`.
|
||||
|
||||
### [Next: Generate and View Traffic]({{<baseurl>}}/rancher/v2.5/en/istio/setup/view-traffic)
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
title: Setup Guide
|
||||
weight: 2
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/
|
||||
---
|
||||
|
||||
This section describes how to enable Istio and start using it in your projects.
|
||||
|
||||
If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below.
|
||||
|
||||
# Prerequisites
|
||||
|
||||
This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v2.5/en/installation) and you have already [provisioned a separate Kubernetes cluster]({{<baseurl>}}/rancher/v2.5/en/cluster-provisioning) on which you will install Istio.
|
||||
|
||||
The nodes in your cluster must meet the [CPU and memory requirements.]({{<baseurl>}}/rancher/v2.5/en/istio/resources/)
|
||||
|
||||
The workloads and services that you want to be controlled by Istio must meet [Istio's requirements.](https://istio.io/docs/setup/additional-setup/requirements/)
|
||||
|
||||
|
||||
# Install
|
||||
|
||||
> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.5/en/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.5/en/istio/setup/set-up-traffic-management)
|
||||
|
||||
1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.5/en/istio/setup/enable-istio-in-cluster)
|
||||
1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.5/en/istio/setup/enable-istio-in-namespace)
|
||||
1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.5/en/istio/setup/deploy-workloads)
|
||||
1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.5/en/istio/setup/gateway)
|
||||
1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.5/en/istio/setup/set-up-traffic-management)
|
||||
1. [Generate traffic and see Istio in action.]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/setup/view-traffic/ )
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
title: 6. Generate and View Traffic
|
||||
weight: 7
|
||||
aliases:
|
||||
- /rancher/v2.5/en/istio/setup/view-traffic
|
||||
- /rancher/v2.5/en/istio/setup/view-traffic
|
||||
- /rancher/v2.5/en/istio/v2.5/setup/view-traffic
|
||||
- /rancher/v2.x/en/istio/v2.5/setup/view-traffic/
|
||||
---
|
||||
|
||||
This section describes how to view the traffic that is being managed by Istio.
|
||||
|
||||
# The Kiali Traffic Graph
|
||||
|
||||
The Istio overview page provides a link to the Kiali dashboard. From the Kiali dashboard, you are able to view graphs for each namespace. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
|
||||
|
||||
>**Prerequisite:** To enable traffic to show up in the graph, ensure you have prometheus installed in the cluster. Rancher-istio installs Kiali configured by default to work with the rancher-monitoring chart. You can use rancher-monitoring or install your own monitoring solution. Optional: you can change configuration on how data scraping occurs by setting the [Selectors & Scrape Configs]({{<baseurl>}}/rancher/v2.5/en/istio/v2.5/configuration-reference/selectors-and-scrape) options.
|
||||
|
||||
To see the traffic graph,
|
||||
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click the **Kiali** link on the Istio **Overview** page.
|
||||
1. Click on **Graph** in the side nav.
|
||||
1. Change the namespace in the **Namespace** dropdown to view the traffic for each namespace.
|
||||
|
||||
If you refresh the URL to the BookInfo app several times, you should be able to see green arrows on the Kiali graph showing traffic to `v1` and `v3` of the `reviews` service. The control panel on the right side of the graph lets you configure details including how many minutes of the most recent traffic should be shown on the graph.
|
||||
|
||||
For additional tools and visualizations, you can go to Grafana, and Prometheus dashboards from the **Monitoring** **Overview** page
|
||||
Reference in New Issue
Block a user