Skip to content

Commit 83e317f

Browse files
RoRoJbene2k1
RoRoJ
and
bene2k1
authored
feat(tutorial): add tuto for istio and k8s (#4445)
* feat(tutorial): add tuto for istio and k8s * fix(tuto): improve wording * Apply suggestions from code review Co-authored-by: Benedikt Rollik <[email protected]> --------- Co-authored-by: Benedikt Rollik <[email protected]>
1 parent d2cc9a7 commit 83e317f

File tree

2 files changed

+173
-0
lines changed
  • tutorials

2 files changed

+173
-0
lines changed

‎tutorials/deploy-istio-kapsule-proxy-protocol/index.mdx‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
---
2+
meta:
3+
title: Deploying Istio on a Kubernetes Kapsule with ProxyProtocol v2 support
4+
description: Learn how to deploy Istio on a Kubernetes Kapsule cluster with Proxy Protocol v2 support. Follow our step-by-step tutorial to set up a secure and scalable service mesh infrastructure.
5+
content:
6+
h1: Deploying Istio on a Kubernetes Kapsule with ProxyProtocol v2 support
7+
paragraph: Learn how to deploy Istio on a Kubernetes Kapsule cluster with Proxy Protocol v2 support. Follow our step-by-step tutorial to set up a secure and scalable service mesh infrastructure.
8+
categories:
9+
- kubernetes
10+
- load-balancer
11+
tags: kubernetes load-balancer proxy-protocol istio
12+
dates:
13+
validation: 2025-02-18
14+
posted: 2025-02-18
15+
---
16+
17+
Istio is an open source service mesh that lets you run distributed, microservices-based apps anywhere. It helps you manage and connect the different microservices in your Scaleway Kubernetes cluster, making it easier to build and maintain complex applications.
18+
19+
This tutorial describes the steps required to deploy Istio on a Scaleway Kubernetes Kapsule cluster, and configure it to support [Proxy Protocol v2](/load-balancer/concepts/#proxy-protocol). This enables connection information from a client (e.g. their IP address) to be passed through the cluster's Load Balancer onto the target pod or service, via the Istio service mesh.
20+
21+
<Macro id="requirements" />
22+
23+
- A Scaleway account logged into the [console](https://console.scaleway.com)
24+
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
25+
- A [Kubernetes Kapsule cluster](/kubernetes/how-to/create-cluster/) with a Scaleway [Load Balancer service](/kubernetes/reference-content/kubernetes-load-balancer/)
26+
- Set up [kubetcl](/kubernetes/how-to/connect-cluster-kubectl/) and [Helm](/tutorials/kubernetes-package-management-helm/)
27+
28+
## Install Istio with Helm
29+
30+
1. Add the Istio Helm repository:
31+
32+
```
33+
helm repo add istio https://istio-release.storage.googleapis.com/charts
34+
helm repo update
35+
```
36+
37+
2. Install the Istio control plane:
38+
39+
```
40+
helm install istiod istio/istiod -n istio-system --create-namespace
41+
```
42+
43+
3. Install the Istio ingress Gateway:
44+
45+
```
46+
helm install istio-ingressgateway istio/gateway -n istio-system
47+
```
48+
49+
## Verify the ingress Gateway Service
50+
51+
An ingress gateway service acts as an entry point for external traffic into the cluster. It is exposed via a Kubernetes LoadBalancer Service, which, in our case, uses a Scaleway Load Balancer. The Load Balancer forwards external traffic to the ingress Gateway Pod.
52+
53+
1. Run the following command to retrieve the service configuration
54+
55+
```
56+
kubectl get svc istio-ingressgateway -n istio-system -o yaml
57+
```
58+
59+
2. Verify that the service is of type `LoadBalancer`, and that a Scaleway Load Balancer is associated with it.
60+
61+
## Add annotations for Proxy Protocol
62+
63+
Add the necessary annotations for Proxy Protocol:
64+
65+
```
66+
kubectl annotate -n istio-system svc istio-ingressgateway "service.beta.kubernetes.io/scw-load-balancer-proxy-protocol-v2=false" --overwrite
67+
kubectl patch svc istio-ingressgateway -n istio-system -p '{"spec": {"externalTrafficPolicy": "Local"}}'
68+
```
69+
70+
## Configure Envoy to support Proxy Protocol
71+
72+
Envoy is a proxy server used by Istio to manage and control the flow of traffic between services in the Kubernetes cluster. It is responsible for routing the traffic between services.
73+
74+
1. Create an EnvoyFilter to enable Proxy Protocol support:
75+
76+
```yaml
77+
apiVersion: networking.istio.io/v1alpha3
78+
kind: EnvoyFilter
79+
metadata:
80+
name: proxy-protocol
81+
namespace: istio-system
82+
spec:
83+
workloadSelector:
84+
labels:
85+
istio: ingressgateway
86+
configPatches:
87+
- applyTo: LISTENER
88+
patch:
89+
operation: MERGE
90+
value:
91+
listener_filters:
92+
- name: envoy.filters.listener.proxy_protocol
93+
- name: envoy.filters.listener.tls_inspector
94+
```
95+
96+
2. Apply the configuration:
97+
98+
```
99+
kubectl apply -f proxy-protocol.yaml
100+
```
101+
102+
## Enable X-Forwarded-For
103+
104+
1. Create a file named `ingressgateway-settings.yaml` with the following content:
105+
106+
```yaml
107+
apiVersion: networking.istio.io/v1alpha3
108+
kind: EnvoyFilter
109+
metadata:
110+
name: ingressgateway-settings
111+
namespace: istio-system
112+
spec:
113+
configPatches:
114+
- applyTo: NETWORK_FILTER
115+
match:
116+
listener:
117+
filterChain:
118+
filter:
119+
name: envoy.http_connection_manager
120+
patch:
121+
operation: MERGE
122+
value:
123+
name: envoy.http_connection_manager
124+
typed_config:
125+
"@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager"
126+
skip_xff_append: false
127+
use_remote_address: true
128+
xff_num_trusted_hops: 1
129+
```
130+
131+
2. Apply the configuration:
132+
133+
```
134+
kubectl apply -f ingressgateway-settings.yaml
135+
```
136+
137+
3. Update the ingress Gateway service to use the new configuration:
138+
139+
```
140+
kubectl annotate -n istio-system svc istio-ingressgateway "service.beta.kubernetes.io/scw-load-balancer-proxy-protocol-v2=false" --overwrite
141+
kubectl patch svc istio-ingressgateway -n istio-system -p '{"spec": {"externalTrafficPolicy": "Local"}}'
142+
```
143+
144+
## Restart the Istio ingress gateway pod
145+
146+
Restart the pod to apply the changes:
147+
148+
```
149+
kubectl delete pod -l istio=ingressgateway -n istio-system
150+
```
151+
152+
## Verify the configuration
153+
154+
1. Retrieve the public IP address of the Load Balancer:
155+
156+
```
157+
kubectl get svc istio-ingressgateway -n istio-system
158+
```
159+
160+
2. Test access using curl:
161+
```
162+
curl -v http://<LOAD_BALANCER_IP>/get
163+
```
164+
165+
If the configuration is correct, the response should include the `X-Forwarded-For` and `X-Envoy-External-Address` headers.
166+
167+
168+
For further support with Istio, read their [dedicated documentation](https://istio.io/latest/docs/).
169+

‎tutorials/proxy-protocol-v2-load-balancer/index.mdx‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ dates:
1818

1919
This tutorial shows you how and why to enable Proxy Protocol on your Scaleway Load Balancer, and how to configure your backend server application to correctly handle the protocol.
2020

21+
<Message type="tip">
22+
If you are looking to configure Proxy Protocol via Istio on a Scaleway Kubernetes Kapsule, see our [dedicated tutorial](/tutorials/deploy-istio-kapsule-proxy-protocol/)
23+
</Message>
24+
2125
<Macro id="requirements" />
2226

2327
- A Scaleway account logged into the [console](https://console.scaleway.com)

0 commit comments

Comments
 (0)