Connect VM Workloads to Istio mesh¶
This document is a recipe illustrating Istio mesh expansion using a single network and a single cluster.
We install Istio and deploy all BookInfo services to the mesh, with the exception of the ratings service, which will run separately on a VM.
The idea is to make this work, and thereby to demonstrate that Istio supports a mesh where some services run in-cluster and some outside it.
The artifacts referenced in these instructions can be obtained from the GitHub repository for this site.
- A GCP or other cloud account
Create K8s Cluster¶
Wait until cluster is ready.
Create the VM¶
Install ratings app on the VM¶
Wait for the machine to be ready.
Copy over the ratings app
ssh onto the VM
Install nodejs, the ratings app and start it, test it.
Run the app:
Test the app.
Retrieve a rating.
Allow POD-to-VM traffic on port 9080¶
Deploy BookInfo (sans ratings)¶
Turn on sidecar-injection.
Deploy the reviews service.
Important: the reviews service uses an environment variable named
SERVICES_DOMAINthat we use to adjust the ratings app target url to reflect the fact that it resides in a different namespace.
Deploy the remaining services.
Install east-west gateway and expose Istiod¶
Control plane traffic between the VM and istiod goes through this gateway (see the Istio documentation).
Install the gateway
Create the ratings namespace and service account¶
The ratings service running on the VM will map to the ratings namespace in kubernetes.
Create the WorkloadGroup¶
A WorkloadGroup is a template for WorkloadEntry objects, see the Istio reference.
Apply the workloadgroup:
Generate VM artifacts¶
Note: check that
vm_files/hosts is not blank. If it is, it means you ran the command too soon. Re-run it.
VM configuration recipe¶
Copy the generated artifacts to the VM.
Ssh onto the VM
And, on the VM, run the following commands (taken from here).
sudo mkdir -p /etc/certs sudo cp ~/root-cert.pem /etc/certs/root-cert.pem sudo mkdir -p /var/run/secrets/tokens sudo cp ~/istio-token /var/run/secrets/tokens/istio-token curl -LO https://storage.googleapis.com/istio-release/releases/1.13.2/deb/istio-sidecar.deb sudo dpkg -i istio-sidecar.deb sudo cp ~/cluster.env /var/lib/istio/envoy/cluster.env sudo cp ~/mesh.yaml /etc/istio/config/mesh sudo sh -c 'cat $(eval echo ~$SUDO_USER)/hosts >> /etc/hosts' sudo mkdir -p /etc/istio/proxy sudo chown -R istio-proxy /etc/certs /var/run/secrets /var/lib/istio /etc/istio/config /etc/istio/proxy
Watch the WorkloadEntry get created as a consequence of the VM registering with the mesh.
On the VM:
Notice the workload entry show up in the listing. This can take up to a minute.
Although the ratings service does not need to call back into the mesh, we can manually test communication from the VM into the mesh.
From the VM, run:
Test communication from a pod to the ratings service running on the VM.
Create a ClusterIP service to front the application:
Create a temporary client pod in the default namespace
From within the container, run the curl command:
exit the container.
Put it all together¶
Grab your load balancer public IP address:
Open a browser and visit the BookInfo product page (at /productpage). Verify that you can see ratings on the page.