 |
VOOZH | about |
|
VOOZH | about |
We’re so glad you’re here. You can expect all the best TNS content to arrive Monday through Friday to keep you on top of the news and at the top of your game.
Check your inbox for a confirmation email where you can adjust your preferences and even join additional groups.
Follow TNS on your favorite social media networks.
Become a TNS follower on LinkedIn.
Check out the latest featured and trending stories while you wait for your first TNS newsletter.
IngressRoute config to rewrite the “Host” header to match the destination, and forwards the request to the targeted service, which is a several step process:
PeerAuthentication policy dictates STRICT mTLS), and forwards the request to a pod of the target service.| # Exclude the ports that Traefik receives traffic on traffic.sidecar.istio.io/excludeInboundPorts: “80” # Make sure Traefik controller can talk to the Kubernetes API server traffic.sidecar.istio.io/excludeOutboundIPRanges: X.X.X.X/32 |
IngressRoute with a Traefik Middleware object that rewrites the hostname to one recognized by the mesh (i.e. a service in the cluster; this is discussed below in the details with an example).gcloud container clusters create istio-traefik \ --cluster-version=1.17 \ --region <GCP region> \ --machine-type=e2-standard-4 \ --project <GCP Project> \ --num-nodes 1 \ --node-locations <GCP Zone> # i.e us-west2-b (otherwise 1 node per zone)
curl -sL https://git.io/getLatestIstio |\ ISTIO_VERSION=1.8.1 sh -
./istio-1.8.1/bin/istioctl install \ --set meshConfig.accessLogFile=/dev/stdout \ --skip-confirmation
./istio-1.8.1/samples/ folder)
4. Create bookinfo namespace.
kubectl create ns bookinfo
kubectl label namespace bookinfo istio-injection=enabled
kubectl apply -f istio-1.8.1/samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo
cat <<EOF | kubectl apply -f - apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default namespace: bookinfo spec: mtls: mode: STRICT EOF
IngressRoute and Middleware resources as required for your version).
7. Deploy Traefik constructs. Please note that there are some modifications to the documented deployment on the Traefik website (instead of default namespace in Traefik documentation, bookinfo namespace will be specified). The file can be accessed here and applied as follows:
$ kubectl apply -f http://bit.ly/Traefik-CRDs-and-Roles customresourcedefinition.apiextensions.k8s.io/ingressroutes.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/middlewares.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressroutetcps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressrouteudps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsoptions.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsstores.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/traefikservices.traefik.containo.us created clusterrole.rbac.authorization.k8s.io/traefik-ingress-lb created clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-lb created
Type: Loadbalancer” is added to tell GCP to assign an external IP to the service.cat <<EOF | kubectl apply -f - apiVersion: v1 kind: Service metadata: name: traefik namespace: bookinfo spec: ports: - protocol: TCP name: web port: 80 - protocol: TCP name: admin port: 8080 selector: app: traefik-ingress-lb type: LoadBalancer EOF
$ kubectl get svc traefik -n bookinfo NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE traefik LoadBalancer 10.35.244.227 35.236.XXX.XXX 80:31718/TCP,8080:31334/TCP 2m6s
ServiceAccount needs to be applied. Besides the name and namespace, the following changes are introduced to the website example:
Accesslog – added “=true” as it didn’t work without the value.Log.level set to DEBUG will help us to see what’s happening.traffic.sidecar.istio.io annotations (For more details please refer to the previously mentioned Tetrate NGINX article).KUBERNETES_SVC_IP=$( kubectl get svc kubernetes -n default -o jsonpath='{.spec.clusterIP}' )
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: bookinfo
name: traefik-ingress-lb
---
kind: Deployment
apiVersion: apps/v1
metadata:
namespace: bookinfo
name: traefik-ingress-lb
labels:
app: traefik-ingress-lb
spec:
replicas: 1
selector:
matchLabels:
app: traefik-ingress-lb
template:
metadata:
labels:
app: traefik-ingress-lb
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "80"
traffic.sidecar.istio.io/excludeOutboundIPRanges: ${KUBERNETES_SVC_IP}/32
spec:
serviceAccountName: traefik-ingress-lb
containers:
- name: traefik-ingress-lb
image: traefik:v2.3
args:
- --api.insecure
- --accesslog=true
- --providers.kubernetescrd
- --entrypoints.web.address=:80
- --log.level=DEBUG
ports:
- name: web
containerPort: 80
- name: admin
containerPort: 8080
EOF
$ kubectl get pods -n bookinfo -l app=traefik-ingress-lb NAME READY STATUS RESTARTS AGE traefik-ingress-lb-669fc4b77d-74mpx 2/2 Running 0 2m35s
BOOKINFO_IP=$(kubectl -n bookinfo get service traefik -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
curl -I $BOOKINFO_IP
Middleware header rewrite functionality will allow Istio Service mesh to function correctly. In this example, the host needs to be defined as “productpage.bookinfo.svc”. The header can be defined according to the Traefik documentation:
cat <<EOF | kubectl apply -f - apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: name: productpage-header namespace: bookinfo spec: headers: customRequestHeaders: Host: productpage.bookinfo.svc EOF
cat <<EOF | kubectl apply -f - apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: productpage namespace: bookinfo spec: entryPoints: - web routes: - match: PathPrefix(\`/\`) kind: Rule middlewares: - name: productpage-header services: - name: productpage port: 9080 EOF
curl -I $BOOKINFO_IP
TRAEFIK_POD=$( kubectl -n bookinfo get pods -l app=traefik-ingress-lb -o jsonpath='{.items[0].metadata.name}' )
kubectl -n bookinfo logs ${TRAEFIK_POD} -c istio-proxy
[2021-01-05T20:13:55.015Z] "GET /productpage HTTP/1.1" 200 - "-" 0 5179 1069 1069 "10.32.0.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" "4bd443e9-1a2e-4d30-b1e3-398a5005f240" "productpage.bookinfo.svc" "10.32.0.18:9080" outbound|9080||productpage.bookinfo.svc.cluster.local 10.32.0.19:51810 10.32.0.18:9080 10.32.0.1:0 - default [2021-01-05T20:13:56.301Z] "GET /static/bootstrap/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1" 200 - "-" 0 18028 3 3 "10.32.0.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" "8cb44552-c3c8-45dd-8674-4af207ce1648" "productpage.bookinfo.svc" "10.32.0.18:9080" outbound|9080||productpage.bookinfo.svc.cluster.local 10.32.0.19:51810 10.32.0.18:9080 10.32.0.1:0 - default
Feature image via Pixabay.