mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-05-17 10:25:16 +00:00
Add rbac, add overlay information, add scrap config docs
This commit is contained in:
Brenda Rearden
committed by
Catherine Luse
Catherine Luse
parent
72bd167c70
commit
7fb6958725
@@ -2,74 +2,3 @@
|
||||
title: Istio
|
||||
weight: 15
|
||||
---
|
||||
|
||||
_Available as of v2.4.0_
|
||||
|
||||
[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
|
||||
|
||||
> Rancher's Istio integration changed significantly in v2.5. If you are using Rancher v2.4, refer to the [legacy documentation.](../legacy)
|
||||
|
||||
As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
|
||||
|
||||
Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
|
||||
|
||||
This service mesh provides features that include but are not limited to the following:
|
||||
|
||||
- Traffic management features
|
||||
- Enhanced monitoring and tracing
|
||||
- Service discovery and routing
|
||||
- Secure connections and service-to-service authentication with mutual TLS
|
||||
- Load balancing
|
||||
- Automatic retries, backoff, and circuit breaking
|
||||
|
||||
After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
|
||||
|
||||
Rancher's Istio integration comes with support for [Kiali.](https://www.kiali.io/) Kiali provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
|
||||
|
||||
# What's New in Rancher v2.5
|
||||
|
||||
The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
|
||||
|
||||
Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
|
||||
|
||||
A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
|
||||
|
||||
Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
|
||||
|
||||
This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
|
||||
|
||||
# Prerequisites
|
||||
|
||||
Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory](./resources) to run all of the components of Istio.
|
||||
|
||||
# Setup Guide
|
||||
|
||||
Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
|
||||
|
||||
# Disabling Istio
|
||||
|
||||
To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
|
||||
|
||||
# Architecture
|
||||
|
||||
Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
|
||||
|
||||
Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
|
||||
|
||||
Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
|
||||
|
||||
When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
|
||||
|
||||
For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
|
||||
|
||||
### Multiple Ingresses
|
||||
|
||||
By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
|
||||
|
||||
|
||||
|
||||
Additional Ingresses can be configured via the [overlay file] (overlay file link here)
|
||||
|
||||
### Egress Support
|
||||
|
||||
By default an Egress gateway is not installed, but can be configured via the [overlay file] (overlay file link here)
|
||||
@@ -11,7 +11,7 @@ _Available as of v2.4.0_
|
||||
|
||||
As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
|
||||
|
||||
Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
|
||||
Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster administrator, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
|
||||
|
||||
This service mesh provides features that include but are not limited to the following:
|
||||
|
||||
@@ -24,11 +24,23 @@ This service mesh provides features that include but are not limited to the foll
|
||||
|
||||
After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
|
||||
|
||||
Rancher's Istio integration comes with comprehensive visualization aids:
|
||||
Rancher's Istio integration comes with a comprehensive visualization aid:
|
||||
|
||||
- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
|
||||
|
||||
Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project.
|
||||
Istio needs to be set up by a `cluster-admin` before it can be used in a project.
|
||||
|
||||
# What's New in Rancher v2.5
|
||||
|
||||
The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
|
||||
|
||||
Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
|
||||
|
||||
A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
|
||||
|
||||
Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
|
||||
|
||||
This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
|
||||
|
||||
# Prerequisites
|
||||
|
||||
@@ -38,33 +50,27 @@ Before enabling Istio, we recommend that you confirm that your Rancher worker no
|
||||
|
||||
Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
|
||||
|
||||
# Disabling Istio
|
||||
# Remove Istio
|
||||
|
||||
To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
|
||||
To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
|
||||
|
||||
# Migrate From Previous Istio Version
|
||||
|
||||
There is no upgrade path for Istio versions less than 1.7
|
||||
|
||||
# Accessing Visualizations
|
||||
|
||||
> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
|
||||
> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
|
||||
|
||||
After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
|
||||
After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI.
|
||||
|
||||
Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
|
||||
To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus**
|
||||
|
||||
To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
|
||||
To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics.
|
||||
|
||||
You can also get to the visualization tools from the project view.
|
||||
By default, only the `istio-system` namespace will picked up by prometheus, which means the other visualization addons will not have displays for resources deployed in other namespaces. Refer to [selector/scrape config setup](URLNEEDED) to get full use of your Grafana and Kiali dashboards.
|
||||
|
||||
# Viewing the Kiali Traffic Graph
|
||||
|
||||
1. From the project view in Rancher, click **Resources > Istio.**
|
||||
1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
|
||||
|
||||
# Viewing Traffic Metrics
|
||||
|
||||
Istio’s monitoring features provide visibility into the performance of all your services.
|
||||
|
||||
1. From the project view in Rancher, click **Resources > Istio.**
|
||||
1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
|
||||
Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
|
||||
|
||||
# Architecture
|
||||
|
||||
@@ -72,14 +78,18 @@ Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/
|
||||
|
||||
Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
|
||||
|
||||
Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
|
||||
|
||||
When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
|
||||
|
||||
For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
|
||||
For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/)
|
||||
|
||||
### Two Ingresses
|
||||
### Multiple Ingresses
|
||||
|
||||
By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
|
||||
By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace. The result is that your cluster will have two ingresses in your cluster.
|
||||
|
||||
|
||||
|
||||
Additional Istio Ingress gateways can be enabled via the [overlay file.](URLNEEDED)
|
||||
|
||||
### Egress Support
|
||||
|
||||
By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](URLNEEDED)
|
||||
@@ -15,7 +15,7 @@ To uninstall Istio,
|
||||
|
||||
**Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster.
|
||||
|
||||
**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer to.
|
||||
**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations.
|
||||
|
||||
# Disable Istio in a Namespace
|
||||
|
||||
|
||||
@@ -7,12 +7,20 @@ aliases:
|
||||
|
||||
This section describes the permissions required to access Istio features.
|
||||
|
||||
The rancher istio chart installs three `ClusterRoles`
|
||||
|
||||
# Cluster-Admin Access
|
||||
|
||||
By default, only those with the `cluster-admin` `ClusterRole` can:
|
||||
|
||||
- Install istio app in a cluster
|
||||
- Configure resource allocations for Istio
|
||||
|
||||
|
||||
## Admin and Edit access
|
||||
|
||||
By default, only Admin and Edit roles can:
|
||||
|
||||
- Install Istio for the cluster
|
||||
- Configure resource allocations for Istio
|
||||
- Enable and disable Istio sidecar auto-injection for namespaces
|
||||
- Add the Istio sidecar to workloads
|
||||
- View the traffic metrics and traffic graph for the cluster
|
||||
@@ -20,11 +28,19 @@ By default, only Admin and Edit roles can:
|
||||
|
||||
# Summary of Default Permissions for Kubernetes Default roles
|
||||
|
||||
| Permission | Admin | Edit | View |
|
||||
|------------------------------------------|----------------|----------------|-----------------|
|
||||
| Enable and disable Istio for the cluster | ✓ | ✓ | |
|
||||
| Configure Istio resource limits | ✓ | ✓ | |
|
||||
| Enable and disable Istio for a namespace | ✓ | ✓ | |
|
||||
| Enable and disable Istio on workloads | ✓ | ✓ | |
|
||||
| Configure Istio with `kubectl` | ✓ | ✓ | |
|
||||
| View Istio project dashboard, including traffic metrics* | ✓ | ✓ | ✓ |
|
||||
Istio creates three `ClusterRoles` and adds Istio CRD access to the following default K8s `ClusterRole`:
|
||||
|
||||
| ClusterRole create by chart | Default K8s ClusterRole | Rancher Role |
|
||||
| ------------------------------| ---------------------------|---------|
|
||||
| `istio-admin` | admin| Project Owner, Project Member |
|
||||
| `istio-edit`| edit | Project Owner, Project Member |
|
||||
| `istio-view` | view | Read-only |
|
||||
|
||||
Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create (C), Get (G), List (L), Update (U), Patch (P), Delete(D), All (*)) that can be performed.
|
||||
|
||||
|
||||
|CRDs | Admin | Edit | View |
|
||||
|----------------------------| ------| -----| -----|
|
||||
| <ul><li>`config.istio.io`</li><ul><li>`adapters`</li><li>`attributemanifests`<li>`handlers`</li><li>`httpapispecbindings`</li><li>`httpapispecs`</li><li>`instances`</li><li>`quotaspecbindings`</li><li>`quotaspecs`</li><li>`rules`</lli><li>`templates`</li></ul></ul>| GLW | GLW | GLW|
|
||||
|<ul><li>`networking.istio.io`</li><ul><li>`destinationrules`</li><li>`envoyfilters`<li>`gateways`</li><li>`serviceentries`</li><li>`sidecars`</li><li>`virtualservices`</li><li>`workloadentries`</li></ul></ul>| * | * | GLW |
|
||||
|<ul><li>`security.istio.io`</li><ul><li>`authorizationpolicies`</li><li>`peerauthentications`<li>`requestauthentications`</li></ul></ul>| * | * | GLW |
|
||||
@@ -34,59 +34,15 @@ istio-ingressgateway | 2000m | 1024Mi | 10m | 40Mi | Y
|
||||
|
||||
You can individually configure the resource allocation for each type of Istio component. This section includes the default resource allocations for each component.
|
||||
|
||||
To make it easier to schedule the workloads to a node, a cluster administrator can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
|
||||
To make it easier to schedule the workloads to a node, a cluster-admin can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
|
||||
|
||||
You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/docs/concepts/what-is-istio).
|
||||
|
||||
To configure the resources allocated to an Istio component,
|
||||
|
||||
1. In Rancher Dashboard, navigate to your Istio installation in Apps & Marketplace
|
||||
1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file](link to overlayfile install instructions).
|
||||
1. In the Rancher **Cluster Explorer**, navigate to your Istio installation in **Apps & Marketplace**
|
||||
1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file](URLNEEDED).
|
||||
1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
|
||||
1. Click **Upgrade.** to rollout changes
|
||||
|
||||
**Result:** The resource allocations for the Istio components are updated.
|
||||
|
||||
## Istiod
|
||||
|
||||
[Istiod](https://istio.io/latest/docs/ops/deployment/architecture/#istiod) provides the following:
|
||||
|
||||
- Authentication configuration
|
||||
- Service discovery for the Envoy sidecars
|
||||
- Traffic management capabilities for intelligent routing (A/B tests and canary rollouts)
|
||||
- Configuration for resiliency (timeouts, retries, circuit breakers, etc)
|
||||
|
||||
For more information on Istiod, refer to the [documentation](https://istio.io/latest/docs/ops/deployment/architecture/#components).
|
||||
|
||||
## Tracing
|
||||
|
||||
[Distributed tracing](https://istio.io/latest/docs/tasks/observability/distributed-tracing/overview/) enables users to track a request through a service mesh. This makes it easier to troubleshoot problems with latency, parallelism and serialization.
|
||||
|
||||
Option | Description| Required | Default
|
||||
-------|------------|-------|-------
|
||||
Enable Tracing | Whether or not to deploy the istio-tracing. | Yes | True
|
||||
Tracing CPU Limit | CPU resource limit for the istio-tracing pod. | Yes | 500
|
||||
Tracing CPU Reservation | CPU reservation for the istio-tracing pod. | Yes | 100
|
||||
Tracing Memory Limit | Memory resource limit for the istio-tracing pod. | Yes | 1024
|
||||
Tracing Memory Reservation | Memory resource requests for the istio-tracing pod. | Yes | 100
|
||||
Tracing Selector | Ability to select the nodes in which tracing pod is deployed to. To use this option, the nodes must have labels. | No | n/a
|
||||
|
||||
## Ingress Gateway
|
||||
|
||||
The Istio gateway allows Istio features such as monitoring and route rules to be applied to traffic entering the cluster. This gateway is a prerequisite for outside traffic to make requests to Istio.
|
||||
|
||||
For more information, refer to the [documentation](https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/).
|
||||
|
||||
Option | Description| Required | Default
|
||||
-------|------------|-------|-------
|
||||
Enable Ingress Gateway | Whether or not to deploy the istio-ingressgateway. | Yes | False
|
||||
Service Type of Istio Ingress Gateway | How to expose the gateway. You can choose NodePort or Loadbalancer | Yes | NodePort
|
||||
Http2 Port | The NodePort for http2 requests | Yes | 31380
|
||||
Https Port | The NodePort for https requests | Yes | 31390
|
||||
Load Balancer IP | Ingress Gateway Load Balancer IP | No | n/a
|
||||
Load Balancer Source Ranges | Ingress Gateway Load Balancer Source Ranges | No | n/a
|
||||
Ingress Gateway CPU Limit | CPU resource limit for the istio-ingressgateway pod. | Yes | 2000
|
||||
Ingress Gateway CPU Reservation | CPU reservation for the istio-ingressgateway pod. | Yes | 100
|
||||
Ingress Gateway Memory Limit | Memory resource limit for the istio-ingressgateway pod. | Yes | 1024
|
||||
Ingress Gateway Memory Reservation | Memory resource requests for the istio-ingressgateway pod. | Yes | 128
|
||||
Ingress Gateway Selector | Ability to select the nodes in which istio-ingressgateway pod is deployed to. To use this option, the nodes must have labels. | No | n/a
|
||||
**Result:** The resource allocations for the Istio components are updated.
|
||||
@@ -7,20 +7,8 @@ aliases:
|
||||
|
||||
This section describes how to enable Istio and start using it in your projects.
|
||||
|
||||
This section assumes that you have Rancher installed, and you have a Rancher-provisioned Kubernetes cluster where you would like to set up Istio.
|
||||
|
||||
If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below.
|
||||
|
||||
> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
|
||||
|
||||
1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
|
||||
1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
|
||||
1. [Select the nodes where the main Istio components will be deployed.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
|
||||
1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
|
||||
1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
|
||||
1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
|
||||
1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
|
||||
|
||||
# Prerequisites
|
||||
|
||||
This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v2.x/en/installation) and you have already [provisioned a separate Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning) on which you will install Istio.
|
||||
@@ -28,3 +16,15 @@ This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v
|
||||
The nodes in your cluster must meet the [CPU and memory requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/)
|
||||
|
||||
The workloads and services that you want to be controlled by Istio must meet [Istio's requirements.](https://istio.io/docs/setup/additional-setup/requirements/)
|
||||
|
||||
|
||||
# Install
|
||||
|
||||
> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
|
||||
|
||||
1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
|
||||
1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
|
||||
1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
|
||||
1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
|
||||
1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
|
||||
1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
|
||||
|
||||
@@ -5,22 +5,46 @@ aliases:
|
||||
- /rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads
|
||||
---
|
||||
|
||||
> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled.
|
||||
> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have the Istio app installed.
|
||||
|
||||
Enabling Istio in a namespace only enables automatic sidecar injection for new workloads. To enable the Envoy sidecar for existing workloads, you need to enable it manually for each workload.
|
||||
|
||||
To inject the Istio sidecar on an existing workload in the namespace, go to the workload, click the **⋮,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
|
||||
To inject the Istio sidecar on an existing workload in the namespace, from the **Cluster Explorer** go to the workload, click the **⋮,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
|
||||
|
||||
Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see istio-init and istio-proxy alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
|
||||
Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see `istio-proxy` alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
|
||||
|
||||
### 3. Add Deployments and Services
|
||||
|
||||
There are a few ways to add new **Deployments** in your namespace
|
||||
|
||||
1. From the **Cluster Explorer** click on Workload > Overview
|
||||
1. Click **Create**
|
||||
1. Select **Deployment** from the various workload options
|
||||
1. Fill out the form, or **Edit as Yaml**
|
||||
1. Click **Create**
|
||||
|
||||
Alternatively, you can select the specific workload you want to deploy from worklod > specific workload and create from there.
|
||||
|
||||
To add a **Service** to your namespace
|
||||
|
||||
1. From the **Cluster Explorer** click on **Service Discovery > Services**
|
||||
1. Click **Create**
|
||||
1. Select the type of service you want to create from the various options
|
||||
1. Fill out the form, or **Edit as Yaml**
|
||||
1. Click **Create**
|
||||
|
||||
You can also create deployments and services using the kubectl **shell**
|
||||
1. Run `kubectl create -f <name of service/deployment file>.yaml` if your file is stored locally in the cluster
|
||||
1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command.
|
||||
|
||||
### 4. Example Deployments and Services
|
||||
|
||||
Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation.
|
||||
|
||||
1. Go to the project inside the cluster you want to deploy the workload on.
|
||||
1. In Workloads, click **Import YAML.**
|
||||
1. Copy the below resources into the form.
|
||||
1. Click **Import.**
|
||||
1. From the **Cluster Explorer**, open the kubectl **shell**
|
||||
1. Run `cat<< EOF | kubectl apply -f -`
|
||||
1. Copy the below resources into the the shell
|
||||
1. Run `EOF`
|
||||
|
||||
This will set up the following sample resources from Istio's example BookInfo app:
|
||||
|
||||
|
||||
@@ -5,17 +5,15 @@ aliases:
|
||||
- /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster
|
||||
---
|
||||
|
||||
This cluster uses the default Nginx controller to allow traffic into the cluster.
|
||||
|
||||
Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster.
|
||||
|
||||
- Admin
|
||||
- Edit
|
||||
- `cluster-admin`
|
||||
|
||||
> If the cluster has a Pod Security Policy enabled there are [prerequisites steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
|
||||
|
||||
1. From the Rancher Dashboard's **Cluster Explorer** view, navigate to available Charts in **Apps & Marketplace**
|
||||
1. From the **Cluster Explorer**, navigate to available **Charts** in **Apps & Marketplace**
|
||||
1. Select the Istio chart from the rancher provided charts
|
||||
1. If you have not already installed your own monitoring app, you will be prompted to install the rancher-monitoring app. Optional: Set your Selector or Scrape config options on rancher-monitoring app install.
|
||||
1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
|
||||
1. Optional: Make additional configuration changes to values.yaml if needed
|
||||
1. Optional: Add additional resources or configuration via the [overlay file](#overlay-file)
|
||||
@@ -23,20 +21,127 @@ Only a user with the following [Kubernetes default roles](https://kubernetes.io/
|
||||
|
||||
**Result:** Istio is installed at the cluster level.
|
||||
|
||||
The Istio application, `rancher-istio`, is added as an application to the cluster's `system` project.
|
||||
Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed.
|
||||
|
||||
When Istio is installed in the cluster, the label for Istio sidecar auto injection,`istio-injection=enabled`, will be automatically added to each new namespace in this cluster. This automatically enables Istio sidecar injection in all new workloads that are deployed in those namespaces. You will need to manually enable Istio in preexisting namespaces and workloads.
|
||||
## Additonal Config Options
|
||||
|
||||
### [Next: Enable Istio in a Namespace]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
|
||||
|
||||
|
||||
### Advanced Config Options
|
||||
|
||||
## Overlay File
|
||||
### Overlay File
|
||||
|
||||
An Overlay File is designed to support extensive configuration of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario.
|
||||
|
||||
The Overlay File will add configuration on top of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation.
|
||||
|
||||
For more information on Overlay Files, refer to the (documentation)[https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings]
|
||||
For more information on Overlay Files, refer to the [documentation](https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings)
|
||||
|
||||
## Selectors & Scrape Configs
|
||||
|
||||
The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=true` which means only the `istio-system` namespace will be scraped by prometheus by default. To ensure you can view traffic, metrics and graphs for resources deployed in other namespaces you will need to add additional configuration.
|
||||
|
||||
There are three different ways to enable prometheus to detect resources in other namespaces:
|
||||
|
||||
1. Add a Service Monitor or Pod Monitor in the namespace with the targets you want to scrape.
|
||||
1. Set `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` on your rancher-monitoring instance.
|
||||
1. Add an `additionalScrapeConfig` to your rancher-monitoring instance to scrape all targets in all namespaces.
|
||||
|
||||
**Option 1: Create a Service Monitor or Pod Monitor**
|
||||
|
||||
This option allows you to define which specific services or pods you would like monitored in a specific namespace.
|
||||
|
||||
>Usability tradeoff is that you have to create the service monitor / pod monitor per namespace since you cannot monitor across namespaces.
|
||||
|
||||
**Pre Requisite:** define a ServiceMonitor or PodMonitor for `<your namespace>`. Example ServiceMonitor is provided below.
|
||||
|
||||
1. From the **Cluster Explorer**, open the kubectl shell
|
||||
1. Run `kubectl create -f <name of service/pod monitor file>.yaml` if the file is stored locally in your cluster.
|
||||
1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command.
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart and scroll down to **Preview Yaml**.
|
||||
1. Run `kubectl label namespace <your namespace> istio-injection=enabled` to enable the envoy sidecar injection
|
||||
|
||||
**Result:** `<your namspace>` can be scraped by prometheus.
|
||||
|
||||
**Example Service Monitor for Istio Proxies**
|
||||
|
||||
```yaml
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: envoy-stats-monitor
|
||||
namespace: istio-system
|
||||
labels:
|
||||
monitoring: istio-proxies
|
||||
spec:
|
||||
selector:
|
||||
matchExpressions:
|
||||
- {key: istio-prometheus-ignore, operator: DoesNotExist}
|
||||
namespaceSelector:
|
||||
any: true
|
||||
jobLabel: envoy-stats
|
||||
endpoints:
|
||||
- path: /stats/prometheus
|
||||
targetPort: 15090
|
||||
interval: 15s
|
||||
relabelings:
|
||||
- sourceLabels: [__meta_kubernetes_pod_container_port_name]
|
||||
action: keep
|
||||
regex: '.*-envoy-prom'
|
||||
- action: labeldrop
|
||||
regex: "__meta_kubernetes_pod_label_(.+)"
|
||||
- sourceLabels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
targetLabel: namespace
|
||||
- sourceLabels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
targetLabel: pod_name
|
||||
```
|
||||
|
||||
**Option 2: Set ingnoreNamspaceSelectors to False**
|
||||
|
||||
This enables monitoring accross namespaces which means ServiceMonitors or PodMonitors will not need to be created per namespace.
|
||||
|
||||
>Potential security trade off is users in namespace A can create a service monitor that monitors services in namespace B despite not having permissions to namespace B
|
||||
1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace**
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true`
|
||||
1. Complete install or upgrade
|
||||
|
||||
**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
|
||||
|
||||
**Option 3: Set ingnoreNamspaceSelectors to False**
|
||||
|
||||
This enables monitoring accross namespaces by giving prometheus additional scrape configurations.
|
||||
|
||||
>Usability tradeoff is that all of prometheus' additionalScrapeConfigs are maintained in a single Secret. This could make upgrading difficult if monitoring is already deployed with additionalScrapeConfigs prior to installing Istio.
|
||||
1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**.
|
||||
1. If updating an existing installation, click on **Upgrade** and then **Preview Yaml**.
|
||||
1. Set`prometheus.prometheusSpec.additionalScrapeConfigs` array to the **Additional Scrape Config** provided below.
|
||||
1. Complete install or upgrade
|
||||
|
||||
**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
|
||||
|
||||
**Additional Scrape Config:**
|
||||
``` yaml
|
||||
- job_name: 'istio/envoy-stats'
|
||||
scrape_interval: 15s
|
||||
metrics_path: /stats/prometheus
|
||||
kubernetes_sd_configs:
|
||||
- role: pod
|
||||
relabel_configs:
|
||||
- source_labels: [__meta_kubernetes_pod_container_port_name]
|
||||
action: keep
|
||||
regex: '.*-envoy-prom'
|
||||
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
||||
action: replace
|
||||
regex: ([^:]+)(?::\d+)?;(\d+)
|
||||
replacement: $1:15090
|
||||
target_label: __address__
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_pod_label_(.+)
|
||||
- source_labels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
target_label: namespace
|
||||
- source_labels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
target_label: pod_name
|
||||
```
|
||||
@@ -13,32 +13,33 @@ To allow Istio to receive external traffic, you need to enable Istio's gateway,
|
||||
|
||||
You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
|
||||
|
||||
You can route traffic into the service mesh with a load balancer or just Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
|
||||
You can route traffic into the service mesh with a load balancer or use Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
|
||||
|
||||
For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/)
|
||||
|
||||
|
||||
|
||||
# Enable the Istio Gateway
|
||||
# Enable an Istio Gateway
|
||||
|
||||
The ingress gateway is a Kubernetes service that will be deployed in your cluster. There is only one Istio gateway per cluster.
|
||||
The ingress gateway is a Kubernetes service that will be deployed in your cluster. The Istio Gateway allows for more extensive customization and flexibility.
|
||||
|
||||
1. Go to the cluster where you want to allow outside traffic into Istio.
|
||||
1. Click **Tools > Istio.**
|
||||
1. Expand the **Ingress Gateway** section.
|
||||
1. Under **Enable Ingress Gateway,** click **True.** The default type of service for the Istio gateway is NodePort. You can also configure it as a [load balancer.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/)
|
||||
1. Optionally, configure the ports, service types, node selectors and tolerations, and resource requests and limits for this service. The default resource requests for CPU and memory are the minimum recommended resources.
|
||||
1. Click **Save.**
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click **Gateways** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Paste your Istio Gateway yaml, or **Read from File**.
|
||||
1. Click **Create**.
|
||||
|
||||
**Result:** The gateway is deployed, which allows Istio to receive traffic from outside the cluster.
|
||||
**Result:** The gateway is deployed, and will now route traffic with applied rules
|
||||
|
||||
# Add a Kubernetes Gateway that Points to the Istio Gateway
|
||||
# Example Istio Gateway
|
||||
|
||||
To allow traffic to reach Ingress, you will also need to provide a Kubernetes gateway resource in your YAML that points to Istio's implementation of the ingress gateway to the cluster.
|
||||
We add the BookInfo app deployments in services when going through the Workloads example. Next we add an Istio Gateway so that the app is accessible from outside your cluster.
|
||||
|
||||
1. Go to the namespace where you want to deploy the Kubernetes gateway and click **Import YAML.**
|
||||
1. Upload the gateway YAML as a file or paste it into the form. An example gateway YAML is provided below.
|
||||
1. Click **Import.**
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click **Gateways** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the Gateway yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
@@ -49,13 +50,23 @@ spec:
|
||||
selector:
|
||||
istio: ingressgateway # use istio default controller
|
||||
servers:
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "*"
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "*"
|
||||
---
|
||||
```
|
||||
|
||||
Then to deploy the VirtualService that provides the traffic routing for the Gateway
|
||||
|
||||
1. Click **VirtualService** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the VirtualService yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
@@ -105,8 +116,8 @@ To test and see if the BookInfo app deployed correctly, the app can be viewed a
|
||||
|
||||
To get the ingress gateway URL and port,
|
||||
|
||||
1. Go to the `System` project in your cluster.
|
||||
1. Within the `System` project, go to `Resources` > `Workloads` then scroll down to the `istio-system` namespace.
|
||||
1. From the **Cluster Explorer**, Click on **Workloads > Overview**.
|
||||
1. Scroll down to the `istio-system` namespace.
|
||||
1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Under the name of this workload, you should see links, such as `80/tcp`.
|
||||
1. Click one of those links. This should show you the URL of the ingress gateway in your web browser. Append `/productpage` to the URL.
|
||||
|
||||
@@ -124,9 +135,8 @@ You can try the steps in this section to make sure the Kubernetes gateway is con
|
||||
|
||||
In the gateway resource, the selector refers to Istio's default ingress controller by its label, in which the key of the label is `istio` and the value is `ingressgateway`. To make sure the label is appropriate for the gateway, do the following:
|
||||
|
||||
1. Go to the `System` project in your cluster.
|
||||
1. Within the `System` project, go to the namespace `istio-system`.
|
||||
1. Within `istio-system`, there is a workload named `istio-ingressgateway`.
|
||||
1. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
|
||||
1. From the **Cluster Explorer**, Click on **Workloads > Overview**.
|
||||
1. Scroll down to the `istio-system` namespace.
|
||||
1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
|
||||
|
||||
### [Next: Set up Istio's Components for Traffic Management]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
---
|
||||
title: 3. Select the Nodes Where Istio Components Will be Deployed
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors
|
||||
---
|
||||
|
||||
> **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources)
|
||||
|
||||
This section describes how use node selectors to configure Istio components to be deployed on a designated node.
|
||||
|
||||
In larger deployments, it is strongly advised that Istio's infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
|
||||
|
||||
# Adding a Label to the Istio Node
|
||||
|
||||
First, add a label to the node where Istio components should be deployed. This label can have any key-value pair. For this example, we will use the key `istio` and the value `enabled`.
|
||||
|
||||
1. From the cluster view, go to the **Nodes** tab.
|
||||
1. Go to a worker node that will host the Istio components and click **⋮ > Edit.**
|
||||
1. Expand the **Labels & Annotations** section.
|
||||
1. Click **Add Label.**
|
||||
1. In the fields that appear, enter `istio` for the key and `enabled` for the value.
|
||||
1. Click **Save.**
|
||||
|
||||
**Result:** A worker node has the label that will allow you to designate it for Istio components.
|
||||
|
||||
# Configuring Istio Components to Use the Labeled Node
|
||||
|
||||
Configure each Istio component to be deployed to the node with the Istio label. Each Istio component can be configured individually, but in this tutorial, we will configure all of the components to be scheduled on the same node for the sake of simplicity.
|
||||
|
||||
For larger deployments, it is recommended to schedule each component of Istio onto separate nodes.
|
||||
|
||||
1. From the cluster view, click **Tools > Istio.**
|
||||
1. Expand the **Pilot** section and click **Add Selector** in the form that appears. Enter the node selector label that you added to the Istio node. In our case, we are using the key `istio` and the value `enabled.`
|
||||
1. Repeat the previous step for the **Mixer** and **Tracing** sections.
|
||||
1. Click **Save.**
|
||||
|
||||
**Result:** The Istio components will be deployed on the Istio node.
|
||||
|
||||
### [Next: Add Deployments and Services]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
|
||||
@@ -18,11 +18,39 @@ After this virtual service is deployed, we will generate traffic and see from th
|
||||
|
||||
To deploy the virtual service and destination rules for the `reviews` service,
|
||||
|
||||
1. Go to the project view and click **Import YAML.**
|
||||
1. Copy resources below into the form.
|
||||
1. Click **Import.**
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click **DestinationRule** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the DestinationRule yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: DestinationRule
|
||||
metadata:
|
||||
name: reviews
|
||||
spec:
|
||||
host: reviews
|
||||
subsets:
|
||||
- name: v1
|
||||
labels:
|
||||
version: v1
|
||||
- name: v2
|
||||
labels:
|
||||
version: v2
|
||||
- name: v3
|
||||
labels:
|
||||
version: v3
|
||||
```
|
||||
|
||||
Then to deploy the VirtualService that provides the traffic routing that utilizes the DestinationRule
|
||||
|
||||
1. Click **VirtualService** in the side nav bar.
|
||||
1. Click **Create from Yaml**.
|
||||
1. Copy and paste the VirtualService yaml provided below.
|
||||
1. Click **Create**.
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
@@ -41,23 +69,8 @@ spec:
|
||||
subset: v3
|
||||
weight: 50
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: DestinationRule
|
||||
metadata:
|
||||
name: reviews
|
||||
spec:
|
||||
host: reviews
|
||||
subsets:
|
||||
- name: v1
|
||||
labels:
|
||||
version: v1
|
||||
- name: v2
|
||||
labels:
|
||||
version: v2
|
||||
- name: v3
|
||||
labels:
|
||||
version: v3
|
||||
```
|
||||
|
||||
**Result:** When you generate traffic to this service (for example, by refreshing the ingress gateway URL), the Kiali traffic graph will reflect that traffic to the `reviews` service is divided evenly between `v1` and `v3`.
|
||||
|
||||
### [Next: Generate and View Traffic]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic)
|
||||
|
||||
@@ -9,20 +9,18 @@ This section describes how to view the traffic that is being managed by Istio.
|
||||
|
||||
# The Kiali Traffic Graph
|
||||
|
||||
Rancher integrates a Kiali graph into the Rancher UI. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
|
||||
The Istio overpage provides a link to the Kiali dashboard. From the Kiali dashboard, you are able to view graphs for each namespace. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
|
||||
|
||||
>**Prerequisite:** To enable traffic to show up in the graph, ensure you have enabled one of the [Selectors & Scrape Configs](NEEDSURL) options. If you do not have this configured, you will not see information on the graph.
|
||||
|
||||
To see the traffic graph,
|
||||
|
||||
1. From the project view in Rancher, click **Resources > Istio.**
|
||||
1. Go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
|
||||
|
||||
1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
|
||||
1. Click the **Kiali** link on the Istio **Overview** page.
|
||||
1. Click on **Graph** in the side nav.
|
||||
1. Change the namespace in the **Namesace** dropdown to view the traffic for each namespace.
|
||||
|
||||
If you refresh the URL to the BookInfo app several times, you should be able to see green arrows on the Kiali graph showing traffic to `v1` and `v3` of the `reviews` service. The control panel on the right side of the graph lets you configure details including how many minutes of the most recent traffic should be shown on the graph.
|
||||
|
||||
For additional tools and visualizations, you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
|
||||
|
||||
# Viewing Traffic Metrics
|
||||
|
||||
Istio’s monitoring features provide visibility into the performance of all your services.
|
||||
|
||||
1. From the project view in Rancher, click **Resources > Istio.**
|
||||
1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.**
|
||||
For additional tools and visualizations, you can go to Grafana, and Prometheus dashboards from the **Monitoring** **Overview** page
|
||||
|
||||
Reference in New Issue
Block a user