Skip to content
This repository was archived by the owner on Aug 31, 2019. It is now read-only.

Commit 7393c51

Browse files
author
Yoichi Kawasaki
committed
Update istio parts
1 parent 4381753 commit 7393c51

10 files changed

+426
-163
lines changed

‎labs/aks-202-istio-top.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
5. [Observability - Distributed Tracing](istio-05-distributed-tracing.md)
99
6. [Traffic Control - Request Routing and Canary Testing](istio-06-routing-canary-testing.md)
1010
7. [Traffic Control - Circuit Breaking](istio-07-circuit-breaking.md)
11-
7. [Egress Gateway - Control Ingress and Egress Traffic (Voting App)](istio-08-ingress-egress-voting.md)
1211

1312
## Other Materials
14-
- [Istio Service Mesh Overview Slides (Japanese)](https://www.slideshare.net/yokawasa/istio-114360124)
13+
- [Istio Service Mesh Overview Slides (Japanese)](https://www.slideshare.net/yokawasa/istio-114360124)

‎labs/istio-01-setup-1.0.4.md‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
# Istio01: Setup Istio
2+
3+
<!-- TOC -->
4+
- [Istio01: Setup Istio](#istio01-setup-istio)
5+
- [Download Istio release package](#download-istio-release-package)
6+
- [Install Istio Core Components](#install-istio-core-components)
7+
- [(a) Install Istio with Helm](#a-install-istio-with-helm)
8+
- [(b) Install Istio without Helm (by applying YAMLs)](#b-install-istio-without-helm-by-applying-yamls)
9+
- [[Supplements] CRDs for Istio](#supplements-crds-for-istio)
10+
- [Check Pods & Services of Istio](#check-pods--services-of-istio)
11+
- [Access Istio endpoints (Forwarding local ports to a Pod.)](#access-istio-endpoints-forwarding-local-ports-to-a-pod)
12+
- [Expose and access Istio endpoints (if you can't access the Istio endpoint by forwarding local ports to a Pod)](#expose-and-access-istio-endpoints-if-you-cant-access-the-istio-endpoint-by-forwarding-local-ports-to-a-pod)
13+
14+
15+
## Download Istio release package
16+
17+
In this workshop, we use `istio-1.0.4`. Run the following command to download `istio-1.0.4` package
18+
19+
```sh
20+
$ curl -L https://raw.githubusercontent.com/yokawasa/azure-container-labs/master/scripts/istio-helpers/get-istio-1.0.4 | sh -
21+
```
22+
> [NOTE] If you want to download the latest Istio, run the following:
23+
> ```sh
24+
> curl -L https://git.io/getLatestIstio | sh -
25+
> ```
26+
27+
Once you download the package, change directory to istio-1.X.X
28+
```sh
29+
cd istio-1.X.X
30+
```
31+
## Install Istio Core Components
32+
33+
To install Istio’s core components, you have options:
34+
- (a) Install Istio with Helm
35+
- (b) Install Istio without Helm (by applying YAMLs)
36+
37+
Please see [Istio - Installation Options](https://istio.io/docs/reference/config/installation-options/) for more details on what options can be added.
38+
39+
### (a) Install Istio with Helm
40+
41+
For a production setup of Istio, it's recommended to install with the Helm Chart, to use all the configuration options.
42+
43+
First of all, check Helm version that you're using, and if you're using a Helm version prior to 2.10.0, install Istio’s Custom Resource Definitions (CRD) via kubectl apply, and wait a few seconds for the CRDs to be committed in the kube-apiserver:
44+
45+
```sh
46+
# Check Helm version
47+
$ helm version
48+
49+
Client: &version.Version{SemVer:"v2.8.2", GitCommit:"a80231648a1473929271764b920a8e346f6de844", GitTreeState:"clean"}
50+
Server: &version.Version{SemVer:"v2.8.2", GitCommit:"a80231648a1473929271764b920a8e346f6de844", GitTreeState:"clean"}
51+
52+
# Install (if you're using < 2.10.0)
53+
$ kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml
54+
55+
# If you are enabling certmanager, you also need to install its CRDs as well and wait a few seconds for the CRDs to be committed in the kube-apiserver:
56+
$ kubectl apply -f install/kubernetes/helm/istio/charts/certmanager/templates/crds.yaml
57+
```
58+
59+
Then, if a service account has not already been installed for `Tiller`, install one by running the follwoing command:
60+
```sh
61+
$ cat <<EOF | kubectl apply -f -
62+
apiVersion: v1
63+
kind: ServiceAccount
64+
metadata:
65+
name: tiller
66+
namespace: kube-system
67+
---
68+
apiVersion: rbac.authorization.k8s.io/v1beta1
69+
kind: ClusterRoleBinding
70+
metadata:
71+
name: tiller
72+
roleRef:
73+
apiGroup: rbac.authorization.k8s.io
74+
kind: ClusterRole
75+
name: cluster-admin
76+
subjects:
77+
- kind: ServiceAccount
78+
name: tiller
79+
namespace: kube-system
80+
EOF
81+
```
82+
83+
Then, install `Tiller` on your cluster with the service account:
84+
```sh
85+
$ helm init --service-account tiller --upgrade
86+
```
87+
88+
Install Istio with addons using Helm:
89+
```sh
90+
$ helm install install/kubernetes/helm/istio --name istio --namespace istio-system \
91+
--set prometheus.enabled=true \
92+
--set tracing.enabled=true \
93+
--set grafana.enabled=true \
94+
--set kiali.enabled=true
95+
```
96+
97+
In this workshop, we use `prometheus` and `grafana` for viewing the metrics from Istio, and `Jaeger` for tracing, and `Kiali` for visualization.
98+
By default, Istio is installed with parameters like `Prometheus:enabled`, `grafana:disabled`, `Jaeger:disabled`, `Kiali:diabled`, therefore, these parameters need to be enabled like above.
99+
100+
For more detail, see [Install with Helm and Tiller via helm install](https://istio.io/docs/setup/kubernetes/helm-install/#option-2-install-with-helm-and-tiller-via-helm-install).
101+
102+
103+
### (b) Install Istio without Helm (by applying YAMLs)
104+
```sh
105+
$ kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml
106+
$ kubectl apply -f install/kubernetes/istio-demo.yaml
107+
```
108+
### [Supplements] CRDs for Istio
109+
110+
Check how many of CRDs installed for Istio with `kubectl get crd` command. Istio consists of bunch of CRDs!
111+
```sh
112+
$ kubectl get crd | wc -l
113+
51
114+
115+
$ kubectl get crd
116+
117+
NAME AGE
118+
adapters.config.istio.io 14m
119+
apikeys.config.istio.io 14m
120+
attributemanifests.config.istio.io 14m
121+
authorizations.config.istio.io 14m
122+
bypasses.config.istio.io 14m
123+
checknothings.config.istio.io 14m
124+
circonuses.config.istio.io 14m
125+
deniers.config.istio.io 14m
126+
destinationrules.networking.istio.io 15m
127+
edges.config.istio.io 14m
128+
envoyfilters.networking.istio.io 15m
129+
fluentds.config.istio.io 14m
130+
gateways.networking.istio.io 15m
131+
handlers.config.istio.io 14m
132+
httpapispecbindings.config.istio.io 15m
133+
httpapispecs.config.istio.io 15m
134+
instances.config.istio.io 14m
135+
kubernetesenvs.config.istio.io 14m
136+
...
137+
```
138+
139+
## Check Pods & Services of Istio
140+
141+
Confrim all pods in `istio-system` namespace are `running`
142+
```
143+
$ kubectl get pods -n istio-system
144+
145+
NAME READY STATUS RESTARTS AGE
146+
grafana-56d946d5b6-4m5tf 1/1 Running 0 1d
147+
istio-citadel-769b85bf84-zhj7z 1/1 Running 0 1d
148+
istio-egressgateway-677c95648f-q662v 1/1 Running 0 1d
149+
istio-galley-5c65774d47-tz2nd 1/1 Running 0 1d
150+
istio-ingressgateway-6fd6575b8b-j6fcm 1/1 Running 0 1d
151+
istio-pilot-65f4cfb764-md9dc 2/2 Running 0 1d
152+
istio-policy-5b9945744b-s2nzg 2/2 Running 0 1d
153+
istio-sidecar-injector-75bfd779c9-z8djf 1/1 Running 0 1d
154+
istio-statsd-prom-bridge-7f44bb5ddb-brscl 1/1 Running 0 1d
155+
istio-telemetry-5fc7ccc5b7-ppgrp 2/2 Running 0 1d
156+
istio-tracing-ff94688bb-f56hv 1/1 Running 0 1d
157+
prometheus-84bd4b9796-trrg9 1/1 Running 0 1d
158+
kiali-5fbd6ffb-r5pq6 1/1 Running 0 1d
159+
```
160+
161+
162+
Get the service list in `istio-system` namespace
163+
```
164+
$ kubectl get svc -n istio-system
165+
166+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
167+
grafana ClusterIP 10.0.213.140 <none> 3000/TCP 10m
168+
istio-citadel ClusterIP 10.0.141.145 <none> 8060/TCP,9093/TCP 11h
169+
istio-egressgateway ClusterIP 10.0.209.229 <none> 80/TCP,443/TCP 11h
170+
istio-galley ClusterIP 10.0.105.143 <none> 443/TCP,9093/TCP 11h
171+
istio-ingressgateway LoadBalancer 10.0.165.160 40.115.180.109 80:31380/TCP,443:31390/TCP,31400:31400/TCP,15011:30898/TCP,8060:30247/TCP,15030:30955/TCP,15031:31046/TCP 11h
172+
istio-pilot ClusterIP 10.0.48.233 <none> 15010/TCP,15011/TCP,8080/TCP,9093/TCP 11h
173+
istio-policy ClusterIP 10.0.66.142 <none> 9091/TCP,15004/TCP,9093/TCP 11h
174+
istio-sidecar-injector ClusterIP 10.0.52.142 <none> 443/TCP 11h
175+
istio-statsd-prom-bridge ClusterIP 10.0.199.206 <none> 9102/TCP,9125/UDP 11h
176+
istio-telemetry ClusterIP 10.0.77.108 <none> 9091/TCP,15004/TCP,9093/TCP,42422/TCP 11h
177+
jaeger-agent ClusterIP None <none> 5775/UDP,6831/UDP,6832/UDP 9m
178+
jaeger-collector ClusterIP 10.0.207.231 <none> 14267/TCP,14268/TCP 9m
179+
jaeger-query ClusterIP 10.0.179.186 <none> 16686/TCP 9m
180+
prometheus ClusterIP 10.0.196.72 <none> 9090/TCP 11h
181+
tracing ClusterIP 10.0.254.69 <none> 80/TCP 9m
182+
zipkin ClusterIP 10.0.181.238 <none> 9411/TCP 9m
183+
```
184+
185+
## Access Istio endpoints (Forwarding local ports to a Pod.)
186+
187+
To port-forward and access `grafana`, run the following commands:
188+
```
189+
$ kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=grafana \
190+
-o jsonpath='{.items[0].metadata.name}') 3000:3000
191+
192+
$ curl http://localhost:3000
193+
```
194+
195+
To port-forward and access `prometheus`, run the following commands:
196+
```
197+
$ kubectl -n istio-system port-forward \
198+
$(kubectl -n istio-system get pod -l app=prometheus -o jsonpath='{.items[0].metadata.name}') 9090:9090
199+
200+
$ curl http://localhost:9090
201+
```
202+
203+
To port-forward and access `Jaeger`, run the follwoing commands:
204+
```
205+
$ kubectl port-forward -n istio-system $(kubectl get pod -n istio-system -l app=jaeger -o jsonpath='{.items[0].metadata.name}') 16686:16686
206+
207+
$ curl http://localhost:16686
208+
```
209+
210+
To port-forward and access `Kiali`, run the follwoing commands (user:pass=`admin`:`admin` by default):
211+
```
212+
$ kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=kiali -o jsonpath='{.items[0].metadata.name}') 20001:20001
213+
214+
$ curl http://localhost:20001
215+
```
216+
217+
218+
## Expose and access Istio endpoints (if you can't access the Istio endpoint by forwarding local ports to a Pod)
219+
220+
For example, if you are using `Azure Cloud Shell`, you can not use local portforward to access internal endpoints in Istio, you need to change the service type from `ClusterIP` to `LoadBalancer`. By changing the type to `LoadBalancer`, you can access the endpoint with Global IP.
221+
222+
Edit the services and change the service type from `ClusterIP` to `LoadBalancer`:
223+
224+
```
225+
# for Prometheus
226+
$ kubectl -n istio-system edit svc prometheus
227+
228+
# for Grafana
229+
$ kubectl -n istio-system edit svc grafana
230+
231+
# for Jaeger
232+
$ kubectl -n istio-system edit svc jaeger-query
233+
234+
# for Kiali
235+
$ kubectl -n istio-system edit svc kiali
236+
```
237+
238+
![](../assets/edit-isito-service.png)
239+
240+
241+
---
242+
[Istio Top](aks-202-istio-top.md)| [Next](istio-02-deploy-bookinfo.md)

0 commit comments

Comments
 (0)