Skip to content

Commit 900ecf4

Browse files
v-regandownerv-regandowner
authored
Merge pull request #233879 from shashankbarsin/shasb/istio-docs
Istio addon overview
2 parents 860d81f + 464d58f commit 900ecf4

File tree

6 files changed

+563
-2
lines changed

6 files changed

+563
-2
lines changed

‎articles/aks/TOC.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -577,6 +577,14 @@
577577
href: open-service-mesh-troubleshoot.md
578578
- name: Uninstall the Open Service Mesh AKS add-on
579579
href: open-service-mesh-uninstall-add-on.md
580+
- name: Istio service mesh AKS add-on
581+
items:
582+
- name: About Istio
583+
href: istio-about.md
584+
- name: Deploy Istio service mesh add-on
585+
href: istio-deploy-addon.md
586+
- name: Deploy external or internal Istio Ingress
587+
href: istio-deploy-ingress.md
580588
- name: Track releases and region availability
581589
href: release-tracker.md
582590
- name: Deploy the Kubernetes Event-driven Autoscaler (KEDA) add-on (preview)

‎articles/aks/index.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,8 +182,8 @@ landingContent:
182182
linkLists:
183183
- linkListType: concept
184184
links:
185-
- text: Open Service Mesh add-on
186-
url: open-service-mesh-about.md
185+
- text: Istio add-on
186+
url: istio-about.md
187187
- text: Dapr cluster extension
188188
url: dapr.md
189189
- text: Cluster extensions

‎articles/aks/istio-about.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
title: Istio-based service mesh add-on for Azure Kubernetes Service (preview)
3+
description: Istio-based service mesh add-on for Azure Kubernetes Service.
4+
ms.topic: article
5+
ms.date: 04/09/2023
6+
ms.author: shasb
7+
---
8+
9+
# Istio-based service mesh add-on for Azure Kubernetes Service (preview)
10+
11+
[Istio][istio-overview] addresses the challenges developers and operators face with a distributed or microservices architecture. The Istio-based service mesh add-on provides an officially supported and tested integration for Azure Kubernetes Service (AKS).
12+
13+
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
14+
15+
## What is a Service Mesh?
16+
17+
Modern applications are typically architected as distributed collections of microservices, with each collection of microservices performing some discrete business function. A service mesh is a dedicated infrastructure layer that you can add to your applications. It allows you to transparently add capabilities like observability, traffic management, and security, without adding them to your own code. The term **service mesh** describes both the type of software you use to implement this pattern, and the security or network domain that is created when you use that software.
18+
19+
As the deployment of distributed services, such as in a Kubernetes-based system, grows in size and complexity, it can become harder to understand and manage. You may need to implement capabilities such as discovery, load balancing, failure recovery, metrics, and monitoring. A service mesh can also address more complex operational requirements like A/B testing, canary deployments, rate limiting, access control, encryption, and end-to-end authentication.
20+
21+
Service-to-service communication is what makes a distributed application possible. Routing this communication, both within and across application clusters, becomes increasingly complex as the number of services grow. Istio helps reduce this complexity while easing the strain on development teams.
22+
23+
## What is Istio?
24+
25+
Istio is an open-source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio enables load balancing, service-to-service authentication, and monitoring – with few or no service code changes. Its powerful control plane brings vital features, including:
26+
27+
* Secure service-to-service communication in a cluster with TLS encryption, strong identity-based authentication and authorization.
28+
* Automatic load balancing for HTTP, gRPC, WebSocket, and TCP traffic.
29+
* Fine-grained control of traffic behavior with rich routing rules, retries, failovers, and fault injection.
30+
* A pluggable policy layer and configuration API supporting access controls, rate limits and quotas.
31+
* Automatic metrics, logs, and traces for all traffic within a cluster, including cluster ingress and egress.
32+
33+
## How is the add-on different from open-source Istio?
34+
35+
This service mesh add-on uses and builds on top of open-source Istio. The add-on flavor provides the following extra benefits:
36+
37+
* Istio versions are tested and verified to be compatible with supported versions of Azure Kubernetes Service.
38+
* Microsoft handles scaling and configuration of Istio control plane
39+
* Microsoft adjusts scaling of AKS components like `coredns` when Istio is enabled.
40+
* Microsoft provides managed lifecycle (upgrades) for Istio components when triggered by user.
41+
* Verified external and internal ingress set-up.
42+
* Verified to work with [Azure Monitor managed service for Prometheus][managed-prometheus-overview] and [Azure Managed Grafana][managed-grafana-overview].
43+
* Official Azure support provided for the add-on.
44+
45+
## Limitations
46+
47+
Istio-based service mesh add-on for AKS has the following limitations:
48+
49+
* The add-on currently doesn't work on AKS clusters using [Azure CNI Powered by Cilium][azure-cni-cilium].
50+
* The add-on doesn't work on AKS clusters that are using [Open Service Mesh addon for AKS][open-service-mesh-about].
51+
* The add-on doesn't work on AKS clusters that have Istio installed on them already outside the add-on installation.
52+
* Managed lifecycle of mesh on how Istio versions are installed and later made available for upgrades.
53+
* Istio doesn't support Windows Server containers.
54+
* Customization of mesh based on the following custom resources is blocked for now - `EnvoyFilter, ProxyConfig, WorkloadEntry, WorkloadGroup, Telemetry, IstioOperator, WasmPlugin`
55+
56+
## Next steps
57+
58+
* [Deploy Istio-based service mesh add-on][istio-deploy-addon]
59+
60+
[istio-overview]: https://istio.io/latest/
61+
[managed-prometheus-overview]: ../azure-monitor/essentials/prometheus-metrics-overview.md
62+
[managed-grafana-overview]: ../managed-grafana/overview.md
63+
[azure-cni-cilium]: azure-cni-powered-by-cilium.md
64+
[open-service-mesh-about]: open-service-mesh-about.md
65+
66+
[istio-deploy-addon]: istio-deploy-addon.md

‎articles/aks/istio-deploy-addon.md

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
---
2+
title: Deploy Istio-based service mesh add-on for Azure Kubernetes Service (preview)
3+
description: Deploy Istio-based service mesh add-on for Azure Kubernetes Service (preview)
4+
ms.topic: article
5+
ms.custom: devx-track-azurecli
6+
ms.date: 04/09/2023
7+
ms.author: shasb
8+
---
9+
10+
# Deploy Istio-based service mesh add-on for Azure Kubernetes Service (preview)
11+
12+
This article shows you how to install the Istio-based service mesh add-on for Azure Kubernetes Service (AKS) cluster.
13+
14+
For more information on Istio and the service mesh add-on, see [Istio-based service mesh add-on for Azure Kubernetes Service][istio-about].
15+
16+
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
17+
18+
## Before you begin
19+
20+
### Set environment variables
21+
22+
```bash
23+
export CLUSTER=<cluster-name>
24+
export RESOURCE_GROUP=<resource-group-name>
25+
export LOCATION=<location>
26+
```
27+
28+
### Verify Azure CLI and aks-preview extension versions
29+
The add-on requires:
30+
* Azure CLI version 2.44.0 or later installed. To install or upgrade, see [Install Azure CLI][install-azure-cli].
31+
* `aks-preview` Azure CLI extension of version 0.5.133 or later installed
32+
33+
You can run `az --version` to verify above versions.
34+
35+
To install the aks-preview extension, run the following command:
36+
37+
```azurecli-interactive
38+
az extension add --name aks-preview
39+
```
40+
41+
Run the following command to update to the latest version of the extension released:
42+
43+
```azurecli-interactive
44+
az extension update --name aks-preview
45+
```
46+
47+
### Register the _AzureServiceMeshPreview_ feature flag
48+
49+
Register the `AzureServiceMeshPreview` feature flag by using the [az feature register][az-feature-register] command:
50+
51+
```azurecli-interactive
52+
az feature register --namespace "Microsoft.ContainerService" --name "AzureServiceMeshPreview"
53+
```
54+
55+
It takes a few minutes for the feature to register. Verify the registration status by using the [az feature show][az-feature-show] command:
56+
57+
```azurecli-interactive
58+
az feature show --namespace "Microsoft.ContainerService" --name "AzureServiceMeshPreview"
59+
```
60+
61+
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
62+
63+
```azurecli-interactive
64+
az provider register --namespace Microsoft.ContainerService
65+
```
66+
67+
## Install Istio add-on at the time of cluster creation
68+
69+
To install the Istio add-on when creating the cluster, use the `--enable-azure-service-mesh` or`--enable-asm` parameter.
70+
71+
```azurecli-interactive
72+
az group create --name ${RESOURCE_GROUP} --location ${LOCATION}
73+
74+
az aks create \
75+
--resource-group ${RESOURCE_GROUP} \
76+
--name ${CLUSTER} \
77+
--enable-asm
78+
```
79+
80+
## Install Istio add-on for existing cluster
81+
82+
The following example enables Istio add-on for an existing AKS cluster:
83+
84+
> [!IMPORTANT]
85+
> You can't enable the Istio add-on on an existing cluster if an OSM add-on is already on your cluster. Uninstall the OSM add-on before installing the Istio add-on.
86+
> For more information, see [uninstall the OSM add-on from your AKS cluster][uninstall-osm-addon].
87+
> Istio add-on can only be enabled on AKS clusters of version >= 1.23.
88+
89+
```azurecli-interactive
90+
az aks mesh enable --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
91+
```
92+
93+
## Verify successful installation
94+
95+
To verify the Istio add-on is installed on your cluster, run the following command:
96+
97+
```azurecli-interactive
98+
az aks show --resource-group ${RESOURCE_GROUP} --name ${CLUSTER} --query 'serviceMeshProfile.mode'
99+
```
100+
101+
Confirm the output shows `Istio`.
102+
103+
Use `az aks get-credentials` to the credentials for your AKS cluster:
104+
105+
```azurecli-interactive
106+
az aks get-credentials --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
107+
```
108+
109+
Use `kubectl` to verify that `istiod` (Istio control plane) pods are running successfully:
110+
111+
```bash
112+
kubectl get pods -n aks-istio-system
113+
```
114+
115+
Confirm the `istiod` pod has a status of `Running`. For example:
116+
117+
```
118+
NAME READY STATUS RESTARTS AGE
119+
istiod-asm-1-17-74f7f7c46c-xfdtl 2/2 Running 0 2m
120+
```
121+
122+
## Enable sidecar injection
123+
124+
To automatically install sidecar to any new pods, annotate your namespaces:
125+
126+
```bash
127+
kubectl label namespace default istio.io/rev=asm-1-17
128+
```
129+
130+
> [!IMPORTANT]
131+
> The default `istio-injection=enabled` labeling doesn't work. Explicit versioning (`istio.io/rev=asm-1-17`) is required.
132+
133+
134+
For manual injection of sidecar using `istioctl kube-inject`, you need to specify extra parameters for `istioNamespace` (`-i`) and `revision` (`-r`). Example:
135+
136+
```bash
137+
kubectl apply -f <(istioctl kube-inject -f sample.yaml -i aks-istio-system -r asm-1-17) -n foo
138+
```
139+
140+
## Deploy sample application
141+
142+
Use `kubectl apply` to deploy the sample application on the cluster:
143+
144+
```bash
145+
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.17/samples/bookinfo/platform/kube/bookinfo.yaml
146+
```
147+
148+
Confirm several deployments and services are created on your cluster. For example:
149+
150+
```
151+
service/details created
152+
serviceaccount/bookinfo-details created
153+
deployment.apps/details-v1 created
154+
service/ratings created
155+
serviceaccount/bookinfo-ratings created
156+
deployment.apps/ratings-v1 created
157+
service/reviews created
158+
serviceaccount/bookinfo-reviews created
159+
deployment.apps/reviews-v1 created
160+
deployment.apps/reviews-v2 created
161+
deployment.apps/reviews-v3 created
162+
service/productpage created
163+
serviceaccount/bookinfo-productpage created
164+
deployment.apps/productpage-v1 created
165+
```
166+
167+
Use `kubectl get services` to verify that the services were created successfully:
168+
169+
```bash
170+
kubectl get services
171+
```
172+
173+
Confirm the following services were deployed:
174+
175+
```
176+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
177+
details ClusterIP 10.0.180.193 <none> 9080/TCP 87s
178+
kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 15m
179+
productpage ClusterIP 10.0.112.238 <none> 9080/TCP 86s
180+
ratings ClusterIP 10.0.15.201 <none> 9080/TCP 86s
181+
reviews ClusterIP 10.0.73.95 <none> 9080/TCP 86s
182+
```
183+
184+
```bash
185+
kubectl get pods
186+
```
187+
188+
Confirm that all the pods have status of `Running`.
189+
190+
```
191+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
192+
details-v1-558b8b4b76-2llld 2/2 Running 0 2m41s
193+
productpage-v1-6987489c74-lpkgl 2/2 Running 0 2m40s
194+
ratings-v1-7dc98c7588-vzftc 2/2 Running 0 2m41s
195+
reviews-v1-7f99cc4496-gdxfn 2/2 Running 0 2m41s
196+
reviews-v2-7d79d5bd5d-8zzqd 2/2 Running 0 2m41s
197+
reviews-v3-7dbcdcbc56-m8dph 2/2 Running 0 2m41s
198+
```
199+
200+
> [!NOTE]
201+
> Each pod has two containers, one of which is the Envoy sidecar injected by Istio and the other is the application container.
202+
203+
To test this sample application against ingress, check out [next-steps](#next-steps).
204+
205+
## Delete resources
206+
207+
Use `kubectl delete` to delete the sample application:
208+
209+
```bash
210+
kubectl delete -f https://raw.githubusercontent.com/istio/istio/release-1.17/samples/bookinfo/platform/kube/bookinfo.yaml
211+
```
212+
213+
If you don't intend to enable Istio ingress on your cluster and want to disable the Istio add-on, run the following command:
214+
215+
```azurecli-interactive
216+
az aks mesh disable --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}
217+
```
218+
219+
> [!CAUTION]
220+
> Disabling the service mesh addon will completely remove the Istio control plane from the cluster.
221+
222+
Istio `CustomResourceDefintion`s (CRDs) aren't be deleted by default. To clean them up, use:
223+
224+
```bash
225+
kubectl delete crd $(kubectl get crd -A | grep "istio.io" | awk '{print $1}')
226+
```
227+
228+
Use `az group delete` to delete your cluster and the associated resources:
229+
230+
```azurecli-interactive
231+
az group delete --name ${RESOURCE_GROUP} --yes --no-wait
232+
```
233+
234+
## Next steps
235+
236+
* [Deploy external or internal ingresses for Istio service mesh add-on][istio-deploy-ingress]
237+
238+
[istio-about]: istio-about.md
239+
240+
[azure-cli-install]: /cli/azure/install-azure-cli
241+
[az-feature-register]: /cli/azure/feature#az-feature-register
242+
[az-feature-show]: /cli/azure/feature#az-feature-show
243+
[az-provider-register]: /cli/azure/provider#az-provider-register
244+
245+
[uninstall-osm-addon]: open-service-mesh-uninstall-add-on.md
246+
[uninstall-istio-oss]: https://istio.io/latest/docs/setup/install/istioctl/#uninstall-istio
247+
248+
[istio-deploy-ingress]: istio-deploy-ingress.md

0 commit comments

Comments
 (0)