service-mesh.md

Deploying to an Istio-enabled cluster

This repository provides an istio-manifests directory containing ingress resources (an Istio Gateway and VirtualService) needed to expose the app frontend running inside a Kubernetes cluster.

You can apply these resources to your cluster in addition to the kubernetes-manifests, then use the Istio IngressGateway's external IP to view the app frontend. See the following instructions for Istio steps.

Steps

1. Create a GKE cluster with at least 4 nodes, machine type e2-standard-4.

PROJECT_ID="<your-project-id>"
ZONE="<your-GCP-zone>"

gcloud container clusters create onlineboutique \
    --project=${PROJECT_ID} \
    --zone=${ZONE} \
    --machine-type=e2-standard-4 \
    --num-nodes=4

Note: Anthos Service Mesh (ASM) requires Workload Identity to be enabled in your GKE cluster.

2. Install Istio on your cluster.

3. Enable Istio sidecar proxy injection in the default Kubernetes namespace.

   kubectl label namespace default istio-injection=enabled

4. Apply all the manifests in the /release directory. This includes the Istio and Kubernetes manifests.

   kubectl apply -f ./release 

5. Run kubectl get pods to see pods are in a healthy and ready state.

6. Find the IP address of your Istio gateway Ingress or Service, and visit the application frontend in a web browser.

   INGRESS_HOST="$(kubectl -n istio-system get service istio-ingressgateway \
      -o jsonpath='{.status.loadBalancer.ingress[0].ip}')"
   echo "$INGRESS_HOST"

   curl -v "http://$INGRESS_HOST"

Additional service mesh demos using OnlineBoutique

• Canary deployment
• Security (mTLS, JWT, Authorization)
• Cloud Operations (Stackdriver)
• Stackdriver metrics (Open source Istio)