Exposing services through Istio Ingress Gateway

The components deployed on the service mesh by default are not exposed outside the cluster. An Ingress Gateway is deployed as a Kubernetes service of type LoadBalancer (or NodePort). To make Bookinfo accessible external to the cluster, you have to create an `Istio Gateway` for the Bookinfo application and also define an `Istio VirtualService` with the routes we need.

Inspecting the Istio Ingress Gateway

The ingress gateway gets exposed as a normal Kubernetes service of type LoadBalancer (or NodePort):

Copy
1kubectl get svc istio-ingressgateway -n istio-system -o yaml

Because the Istio Ingress Gateway is an Envoy Proxy you can inspect it using the admin routes. First find the name of the istio-ingressgateway:

Copy
1kubectl get pods -n istio-system

Copy and paste your ingress gateway's pod name. Execute:

Copy
1kubectl -n istio-system exec -it <istio-ingressgateway-...> bash

You can view the statistics, listeners, routes, clusters and server info for the Envoy proxy by forwarding the local port:

Copy
1curl localhost:15000/help
2curl localhost:15000/stats
3curl localhost:15000/listeners
4curl localhost:15000/clusters
5curl localhost:15000/server_info

See the admin docs for more details.

Also it can be helpful to look at the log files of the Istio ingress controller to see what request is being routed.

Before we check the logs, let us get out of the container back on the host:

Copy
1exit

Now let us find the ingress pod and output the log:

Copy
1kubectl logs istio-ingressgateway-... -n istio-system

View Istio Ingress Gateway for Bookinfo

View the Gateway and VirtualServices

Check the created Istio Gateway and Istio VirtualService to see the changes deployed:

Copy
1kubectl get gateway
2kubectl get gateway -o yaml
3
4kubectl get virtualservices
5kubectl get virtualservices -o yaml

Find the external port of the Istio Ingress Gateway by running:

Copy
1kubectl get service istio-ingressgateway -n istio-system -o wide

To just get the first port of istio-ingressgateway service, we can run this:

Copy
1kubectl get service istio-ingressgateway -n istio-system --template='{{(index .spec.ports 1).nodePort}}'

Create a DNS entry:

Modify you local /etc/hosts file to add an entry for your sample application.

127.0.0.1. bookinfo.meshery.io

The HTTP port is usually 31380.

Or run these commands to retrieve the full URL:

Copy
1echo "http://$(kubectl get nodes --selector=kubernetes.io/role!=master -o jsonpath={.items[0].status.addresses[?\(@.type==\"InternalIP\"\)].address}):$(kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.spec.ports[1].nodePort}')/productpage"

Docker Desktop users please use http://localhost/productpage to access product page in your browser.

In case you are using a managed kubernetes cluster like AKS, EKS, or GCE please follow the procedure described below:

• Get the external IP of the service istio-ingressgateway using the following command:

  Copy
  1kubectl get service istio-ingressgateway -n istio-system

• Using Meshery, navigate to the Custom yaml page, and apply the manifest given below to allow all hosts instead of allowing bookinfo.meshery.io only and you are good to access the page using the following url http://<external-ip of istio-ingressgateway>/productpage.

Copy
1apiVersion: networking.istio.io/v1beta1
2kind: VirtualService
3metadata:
4  name: bookinfo
5spec:
6  gateways:
7  - sample-app-gateway
8  hosts:
9  - "*"
10  http:
11  - match:
12    - uri:
13        exact: /productpage
14    - uri:
15        prefix: /static
16    - uri:
17        exact: /login
18    - uri:
19        exact: /logout
20    - uri:
21        prefix: /api/v1/products
22    route:
23    - destination:
24        host: productpage
25        port:
26          number: 9080

Apply default destination rules

Before we start playing with Istio's traffic management capabilities we need to define the available versions of the deployed services. They are called subsets, in destination rules.

Using Meshery, navigate to the Custom yaml page, and apply the below to create the subsets for BookInfo:

Copy
1apiVersion: networking.istio.io/v1alpha3
2kind: DestinationRule
3metadata:
4  name: productpage
5spec:
6  host: productpage
7  subsets:
8    - name: v1
9      labels:
10        version: v1
11---
12apiVersion: networking.istio.io/v1alpha3
13kind: DestinationRule
14metadata:
15  name: reviews
16spec:
17  host: reviews
18  subsets:
19    - name: v1
20      labels:
21        version: v1
22    - name: v2
23      labels:
24        version: v2
25    - name: v3
26      labels:
27        version: v3
28---
29apiVersion: networking.istio.io/v1alpha3
30kind: DestinationRule
31metadata:
32  name: ratings
33spec:
34  host: ratings
35  subsets:
36    - name: v1
37      labels:
38        version: v1
39    - name: v2
40      labels:
41        version: v2
42    - name: v2-mysql
43      labels:
44        version: v2-mysql
45    - name: v2-mysql-vm
46      labels:
47        version: v2-mysql-vm
48---
49apiVersion: networking.istio.io/v1alpha3
50kind: DestinationRule
51metadata:
52  name: details
53spec:
54  host: details
55  subsets:
56    - name: v1
57      labels:
58        version: v1
59    - name: v2
60      labels:
61        version: v2

This creates destination rules for each of the BookInfo services and defines version subsets

In a few seconds we should be able to verify the destination rules created by using the command below:

Copy
1kubectl get destinationrules
2
3
4kubectl get destinationrules -o yaml

Browse to BookInfo

Browse to the website of the Bookinfo. To view the product page, you will have to append /productpage to the url.

Reload Page

Now, reload the page multiple times and notice how it round robins between v1, v2 and v3 of the reviews service.

Inspect the Istio proxy of the productpage pod

To better understand the istio proxy, let's inspect the details. Let us exec into the productpage pod to find the proxy details. To do so we need to first find the full pod name and then exec into the istio-proxy container:

Copy
1kubectl get pods
2kubectl exec -it productpage-v1-... -c istio-proxy  sh

Once in the container look at some of the envoy proxy details by inspecting it's config file:

Copy
1ps aux
2ls -l /etc/istio/proxy
3cat /etc/istio/proxy/envoy-rev0.json

For more details on envoy proxy please check out their admin docs.

As a last step, lets exit the container:

Copy
1exit

Alternative: Manual installation

Follow this if the above steps did not work for you

Default destination rules

Run the following command to create default destination rules for the Bookinfo services:

Copy
1kubectl apply -f samples/bookinfo/networking/destination-rule-all-mtls.yaml

Configure the Bookinfo route with the Istio Ingress gateway

We can create a virtualservice & gateway for bookinfo app in the ingress gateway by running the following:

Copy
1kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml