You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/istio-about.md
+5-4Lines changed: 5 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,21 +8,21 @@ ms.author: shasb
8
8
9
9
# Istio based service mesh add-on for Azure Kubernetes Service (preview)
10
10
11
-
[Istio][istio-overview] addresses the challenges developers and operators face with a distributed or microservices architecture. The Istiobased service mesh add-on provides an officially supported and tested integration for Azure Kubernetes Service (AKS).
11
+
[Istio][istio-overview] addresses the challenges developers and operators face with a distributed or microservices architecture. The Istio-based service mesh add-on provides an officially supported and tested integration for Azure Kubernetes Service (AKS).
12
12
13
13
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
14
14
15
15
## What is a Service Mesh?
16
16
17
17
Modern applications are typically architected as distributed collections of microservices, with each collection of microservices performing some discrete business function. A service mesh is a dedicated infrastructure layer that you can add to your applications. It allows you to transparently add capabilities like observability, traffic management, and security, without adding them to your own code. The term **service mesh** describes both the type of software you use to implement this pattern, and the security or network domain that is created when you use that software.
18
18
19
-
As the deployment of distributed services, such as in a Kubernetes-based system, grows in size and complexity, it can become harder to understand and manage. Its requirements can include discovery, load balancing, failure recovery, metrics, and monitoring. A service mesh also often addresses more complex operational requirements like A/B testing, canary deployments, rate limiting, access control, encryption, and end-to-end authentication.
19
+
As you deploy distributed services and that system grows in complexity and size, it can become harder to understand and manage. You may need to implement capabilities such as discovery, load balancing, failure recovery, metrics, and monitoring. A service mesh can also address more complex operational requirements like A/B testing, canary deployments, rate limiting, access control, encryption, and end-to-end authentication.
20
20
21
21
Service-to-service communication is what makes a distributed application possible. Routing this communication, both within and across application clusters, becomes increasingly complex as the number of services grow. Istio helps reduce this complexity while easing the strain on development teams.
22
22
23
23
## What is Istio?
24
24
25
-
Istio is an open source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio is the path to load balancing, service-to-service authentication, and monitoring – with few or no service code changes. Its powerful control plane brings vital features, including:
25
+
Istio is an open source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio enables load balancing, service-to-service authentication, and monitoring – with few or no service code changes. Its powerful control plane brings vital features, including:
26
26
27
27
* Secure service-to-service communication in a cluster with TLS encryption, strong identity-based authentication and authorization
28
28
* Automatic load balancing for HTTP, gRPC, WebSocket, and TCP traffic
@@ -32,10 +32,11 @@ Istio is an open source service mesh that layers transparently onto existing dis
32
32
33
33
## How is the add-on different from open source Istio?
34
34
35
-
This service mesh add-on uses and builds on top of open-source Istio. The add-on flavor provides the following extra benefits:
35
+
This service mesh add-on uses and builds on top of opensource Istio. The add-on flavor provides the following extra benefits:
36
36
37
37
* Istio versions are tested and verified to be compatible with supported versions of Azure Kubernetes Service.
38
38
* Scaling of Istio control plane configured and handled by Microsoft.
39
+
* Adjust configuration of AKS components like `coredns` when Istio is enabled.
39
40
* Verified external and internal ingress set-up.
40
41
* Verified to work with [Azure Monitor managed service for Prometheus][managed-prometheus-overview] and [Azure Managed Grafana][managed-grafana-overview].
# Deploy Istio based service mesh add-on for Azure Kubernetes Service (preview)
11
11
12
-
This article shows you how to install the Istiobased service mesh add-on for Azure Kubernetes Service (AKS) cluster.
12
+
This article shows you how to install the Istio-based service mesh add-on for Azure Kubernetes Service (AKS) cluster.
13
13
14
-
A conceptual overview of Istio and the service mesh add-on is available [here][istio-about].
14
+
For more details on Istio and the service mesh add-on, see [Istio based service mesh add-on for Azure Kubernetes Service][istio-about].
15
15
16
-
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
16
+
## Before you begin
17
17
18
-
## Prerequisites
18
+
You need the Azure CLI version 2.44.0 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
19
19
20
-
* An Azure subscription. If you don't have an Azure subscription, you can create a [free account](https://azure.microsoft.com/free).
21
-
*[Azure CLI][azure-cli-install] and the CLI extension `aks-preview` of version >= 0.5.135 are installed.
20
+
Set environment variables:
22
21
23
-
* If `aks-preview` isn't already installed, run the following command:
22
+
```bash
23
+
export CLUSTER=<cluster-name>
24
+
export RESOURCE_GROUP=<resource-group-name>
25
+
export LOCATION=<location>
26
+
```
24
27
25
-
```azurecli
26
-
az extension add --name aks-preview
27
-
```
28
+
## Install the aks-preview Azure CLI extension
28
29
29
-
* If `aks-preview`is already installed, run the following command to update it to the latest version:
30
+
You need the `aks-preview`Azure CLI extension of version 0.5.133 or later installed and configured. Run `az --version`to find the version.
30
31
31
-
```azurecli
32
-
az extension update --name aks-preview
33
-
```
32
+
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
34
33
35
-
* Register the `AzureServiceMeshPreview` feature flag by using the [az feature register][az-feature-register] command:
34
+
To install the aks-preview extension, run the following command:
36
35
37
-
```azurecli
38
-
az feature register --namespace "Microsoft.ContainerService" --name "AzureServiceMeshPreview"
39
-
```
36
+
```azurecli
37
+
az extension add --name aks-preview
38
+
```
40
39
41
-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
40
+
Run the following command to update to the latest version of the extension released:
42
41
43
-
```azurecli
44
-
az feature show --namespace "Microsoft.ContainerService" --name "AzureServiceMeshPreview"
45
-
```
42
+
```azurecli
43
+
az extension update --name aks-preview
44
+
```
46
45
47
-
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
46
+
## Register the 'AzureServiceMeshPreview' feature flag
48
47
49
-
```azurecli-interactive
50
-
az provider register --namespace Microsoft.ContainerService
51
-
```
48
+
Register the `AzureServiceMeshPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
52
49
53
-
* Set environment variables:
50
+
```azurecli-interactive
51
+
az feature register --namespace "Microsoft.ContainerService" --name "AzureServiceMeshPreview"
52
+
```
54
53
55
-
```bash
56
-
export CLUSTER=<cluster-name>
57
-
export RESOURCE_GROUP=<resource-group-name>
58
-
export LOCATION=<location>
59
-
```
54
+
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
60
55
61
-
## Install the Istio add-on on your cluster
56
+
```azurecli-interactive
57
+
az feature show --namespace "Microsoft.ContainerService" --name "AzureServiceMeshPreview"
58
+
```
59
+
60
+
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
61
+
62
+
```azurecli-interactive
63
+
az provider register --namespace Microsoft.ContainerService
64
+
```
65
+
66
+
## Install Istio add-on at the time of cluster creation
62
67
63
-
**Install add-on at the time of cluster creation:**
64
68
To install the Istio add-on when creating the cluster, use `--enable-asm` or `--enable-azure-service-mesh` parameters.
65
69
66
70
```azurecli-interactive
@@ -72,52 +76,51 @@ az aks create \
72
76
--enable-asm
73
77
```
74
78
75
-
**Install add-on for existing cluster:**
79
+
## Install Istio add-on for existing cluster
76
80
77
81
The following example enables Istio add-on for an existing AKS cluster:
78
82
79
-
```azurecli-interactive
80
-
az aks mesh enable --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
81
-
```
82
-
83
83
> [!IMPORTANT]
84
84
> You can't enable the Istio add-on on an existing cluster if an OSM add-on is already on your cluster. [Uninstall OSM add-on on your cluster][uninstall-osm-addon] before enabling the Istio add-on.
85
-
> You can't enable the Istio add-on on an existing cluster if Istio was already installed outside the add-on installation. [Uninstall non-add-on Istio][uninstall-istio-oss] before enabling the Istio add-on.
86
-
> Istio add-on can only be enabled on AKS clusters of version >= 1.23
85
+
> You can't enable the Istio add-on on an existing cluster if an OSM add-on is already on your cluster. Uninstall the OSM add-on before installing the Istio add-on. For more details, see [Uninstall the OSM add-on from your AKS cluster][uninstall-osm-addon].
86
+
> Istio add-on can only be enabled on AKS clusters of version >= 1.23.
87
87
88
+
```azurecli-interactive
89
+
az aks mesh enable --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
90
+
```
88
91
89
92
## Verify add-on was installed successfully
90
93
91
-
1.To see if the Istio add-on is installed on your cluster, run the following command:
94
+
To verify the Istio add-on is installed on your cluster, run the following command:
92
95
93
-
```azurecli-interactive
94
-
az aks show --resource-group ${RESOURCE_GROUP} --name ${CLUSTER} --query 'serviceMeshProfile.mode'
95
-
```
96
+
```azurecli-interactive
97
+
az aks show --resource-group ${RESOURCE_GROUP} --name ${CLUSTER} --query 'serviceMeshProfile.mode'
98
+
```
96
99
97
-
**Expected response:**
100
+
Confirm the output shows Istio, for example:
98
101
99
-
```
100
-
Istio
101
-
```
102
+
```
103
+
Istio
104
+
```
102
105
103
-
1. Get the credentials for your AKS cluster:
106
+
Use `az aks get-credentials` to the credentials for your AKS cluster:
104
107
105
-
```azurecli-interactive
106
-
az aks get-credentials --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
107
-
```
108
+
```azurecli-interactive
109
+
az aks get-credentials --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
110
+
```
108
111
109
-
1. Verify that `istiod` (Istio control plane) pods are running successfully:
112
+
Use `kubectl` to verify that `istiod` (Istio control plane) pods are running successfully:
110
113
111
-
```bash
112
-
kubectl get pods -n aks-istio-system
113
-
```
114
+
```bash
115
+
kubectl get pods -n aks-istio-system
116
+
```
114
117
115
-
**Expected response:**
118
+
Confirm the `istiod` pod has a status of `Running`. For example:
116
119
117
-
```
118
-
NAME READY STATUS RESTARTS AGE
119
-
istiod-asm-1-17-74f7f7c46c-xfdtl 1/1 Running 0 2m
120
-
```
120
+
```
121
+
NAME READY STATUS RESTARTS AGE
122
+
istiod-asm-1-17-74f7f7c46c-xfdtl 2/2 Running 0 2m
123
+
```
121
124
122
125
## Enable sidecar injection
123
126
@@ -127,78 +130,91 @@ To automatically install sidecar to any new pods, annotate your namespaces:
0 commit comments