Installing Istio in Kubernetes

What is Istio?

Istio Logo

Running Microservices or any load under a Kubernetes cluster that includes more than one server, under a micro-service architecture or even a traditional application that needs to access other resources requires functionality to:

  • Load Balance traffic, external o internal
  • Control failures, retries, routing
  • Apply limits and monitor network traffic between services
  • Secure communication

Developing that functionality by ourselves or integrating different solutions to obtain those capabilities requires advanced knowledge of networking protocols, and distributed architectures. It is hard to do it right and, in my opinion pointless.

Be Pragmatic

In IT Wonder Lab we are pragmatic, it is, of course, possible to develop Istio functionality by our selves, but our effort should be better used in solving business and people problems instead of reinventing the wheel. Istio is great!

Istio for Kubernetes provides a service mesh for microservices that solves all those problems. Istio is an open-source project created by teams from Google, IBM, and Lyft.

Istio under VirtualBox

In a previous tutorial, I showed How to Install a Kubernetes Cluster using Vagrant and Ansible, in this tutorial I show how to add Istio as a service mesh for that Kubernetes Cluster.

Installing Istio for Kubernetes under VirtualBox has some peculiarities that need to be addressed to obtain a successful Kubernetes with Istio local development cluster:

  • Resource usage: default CPU and Memory requirements for Istio are too high for most VirtualBox configurations.
  • Lack of external o Cloud Load Balancer: by default, it is not possible to access Istio and Helm (a package manager) in a VirtualBox installation as there is no external or Cloud Load Balancer.

Updates:

  • 10 Nov 2019:
    • Upgrade releases:
      • Istio release to 1.3.4 (was 1.1.3)
      • Helm release to 2.16.0  (was 2.13.1)
  • 3 Aug 2020: WIP
    • Upgrade istio to 1.6.7

Instructions to install Istio in a VirtualBox Kubernetes Cluster

Modern releases of Istio are really easy to install, this tutorial is based on the official Istio Documentation.

Prerequisites:

Check that your Kubernetes Cluster is running and connection can be established by running any kubectl command like kubectl get all:

$ kubectl get all
NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   3h9m

Download Istio

Download Istion by running curl -L https://istio.io/downloadIstio | sh -

$ curl -L https://istio.io/downloadIstio | sh -
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   107  100   107    0     0    183      0 --:--:-- --:--:-- --:--:--   183
100  3896  100  3896    0     0   4809      0 --:--:-- --:--:-- --:--:--  4809
Downloading istio-1.6.7 from https://github.com/istio/istio/releases/download/1.6.7/istio-1.6.7-linux.tar.gz ...Failed.

Trying with TARGET_ARCH. Downloading istio-1.6.7 from https://github.com/istio/istio/releases/download/1.6.7/istio-1.6.7-linux-amd64.tar.gz ...

Istio 1.6.7 Download Complete!
...

Install Istio

$ cd istio-1.6.7
$ export PATH=$PWD/bin:$PATH
$ istioctl install --set profile=demo
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
✔ Istio core installed                                                                                                                              
✔ Istiod installed                                                                                                                                  
✔ Egress gateways installed                                                                                                                         
✔ Ingress gateways installed                                                                                                                        
✔ Addons installed                                                                                                                                  
✔ Installation complete           

Create a NameSpace

Create a label named istio-injection in the default namespace that tells Istio to automatically inject Envoy sidecar proxies in the deployed applications.

$ kubectl label namespace default istio-injection=enabled
namespace/default labeled

Check Istio Installation

List all Kubernetes resources to check that all pods are  running and replicas ready:

$ kubectl get all -A
NAMESPACE              NAME                                             READY   STATUS    RESTARTS   AGE
istio-system           pod/grafana-b54bb57b9-77mdr                      1/1     Running   0          24m
istio-system           pod/istio-egressgateway-64bc874f5c-nmhcx         1/1     Running   0          24m
istio-system           pod/istio-ingressgateway-6b947b8c5d-rshpl        1/1     Running   0          24m
istio-system           pod/istio-tracing-9dd6c4f7c-j76lb                1/1     Running   0          24m
istio-system           pod/istiod-654b4b468b-hcqbj                      1/1     Running   0          24m
istio-system           pod/kiali-d45468dc4-t2qts                        1/1     Running   0          24m
istio-system           pod/prometheus-77566c9987-nbldb                  2/2     Running   0          24m
kube-system            pod/calico-kube-controllers-578894d4cd-sqtxl     1/1     Running   1          3h29m
kube-system            pod/calico-node-p2ncg                            1/1     Running   1          3h18m
kube-system            pod/calico-node-rzvvk                            1/1     Running   1          3h22m
kube-system            pod/calico-node-z4hn6                            1/1     Running   1          3h26m
kube-system            pod/calico-node-zq8pb                            1/1     Running   1          3h29m
kube-system            pod/coredns-66bff467f8-bm5lb                     1/1     Running   1          3h29m
kube-system            pod/coredns-66bff467f8-km79j                     1/1     Running   1          3h29m
kube-system            pod/etcd-k8s-m-1                                 1/1     Running   1          3h29m
kube-system            pod/kube-apiserver-k8s-m-1                       1/1     Running   1          3h29m
kube-system            pod/kube-controller-manager-k8s-m-1              1/1     Running   3          3h29m
kube-system            pod/kube-proxy-47n62                             1/1     Running   1          3h18m
kube-system            pod/kube-proxy-686dw                             1/1     Running   1          3h22m
kube-system            pod/kube-proxy-6q4mn                             1/1     Running   1          3h29m
kube-system            pod/kube-proxy-z9tz6                             1/1     Running   1          3h26m
kube-system            pod/kube-scheduler-k8s-m-1                       1/1     Running   3          3h29m
kubernetes-dashboard   pod/dashboard-metrics-scraper-6b4884c9d5-dbj7v   1/1     Running   1          161m
kubernetes-dashboard   pod/kubernetes-dashboard-7b544877d5-l2ktx        1/1     Running   1          161m

NAMESPACE              NAME                                      TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                      AGE
default                service/kubernetes                        ClusterIP      10.96.0.1        <none>        443/TCP                                                                      3h29m
istio-system           service/grafana                           ClusterIP      10.98.135.195    <none>        3000/TCP                                                                     24m
istio-system           service/istio-egressgateway               ClusterIP      10.96.179.234    <none>        80/TCP,443/TCP,15443/TCP                                                     24m
istio-system           service/istio-ingressgateway              LoadBalancer   10.107.75.76     <pending>     15021:31787/TCP,80:32232/TCP,443:31880/TCP,31400:31278/TCP,15443:30373/TCP   24m
istio-system           service/istiod                            ClusterIP      10.99.49.194     <none>        15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP                                24m
istio-system           service/jaeger-agent                      ClusterIP      None             <none>        5775/UDP,6831/UDP,6832/UDP                                                   24m
istio-system           service/jaeger-collector                  ClusterIP      10.100.144.253   <none>        14267/TCP,14268/TCP,14250/TCP                                                24m
istio-system           service/jaeger-collector-headless         ClusterIP      None             <none>        14250/TCP                                                                    24m
istio-system           service/jaeger-query                      ClusterIP      10.97.77.31      <none>        16686/TCP                                                                    24m
istio-system           service/kiali                             ClusterIP      10.105.199.34    <none>        20001/TCP                                                                    24m
istio-system           service/prometheus                        ClusterIP      10.100.66.206    <none>        9090/TCP                                                                     24m
istio-system           service/tracing                           ClusterIP      10.102.206.3     <none>        80/TCP                                                                       24m
istio-system           service/zipkin                            ClusterIP      10.97.113.137    <none>        9411/TCP                                                                     24m
kube-system            service/kube-dns                          ClusterIP      10.96.0.10       <none>        53/UDP,53/TCP,9153/TCP                                                       3h29m
kubernetes-dashboard   service/dashboard-metrics-scraper         ClusterIP      10.104.13.49     <none>        8000/TCP                                                                     161m
kubernetes-dashboard   service/kubernetes-dashboard              ClusterIP      10.99.231.65     <none>        443/TCP                                                                      161m
kubernetes-dashboard   service/kubernetes-dashboard-service-np   NodePort       10.98.42.164     <none>        8443:30002/TCP                                                               161m

NAMESPACE     NAME                         DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
kube-system   daemonset.apps/calico-node   4         4         4       4            4           kubernetes.io/os=linux   3h29m
kube-system   daemonset.apps/kube-proxy    4         4         4       4            4           kubernetes.io/os=linux   3h29m

NAMESPACE              NAME                                        READY   UP-TO-DATE   AVAILABLE   AGE
istio-system           deployment.apps/grafana                     1/1     1            1           24m
istio-system           deployment.apps/istio-egressgateway         1/1     1            1           24m
istio-system           deployment.apps/istio-ingressgateway        1/1     1            1           24m
istio-system           deployment.apps/istio-tracing               1/1     1            1           24m
istio-system           deployment.apps/istiod                      1/1     1            1           24m
istio-system           deployment.apps/kiali                       1/1     1            1           24m
istio-system           deployment.apps/prometheus                  1/1     1            1           24m
kube-system            deployment.apps/calico-kube-controllers     1/1     1            1           3h29m
kube-system            deployment.apps/coredns                     2/2     2            2           3h29m
kubernetes-dashboard   deployment.apps/dashboard-metrics-scraper   1/1     1            1           161m
kubernetes-dashboard   deployment.apps/kubernetes-dashboard        1/1     1            1           161m

NAMESPACE              NAME                                                   DESIRED   CURRENT   READY   AGE
istio-system           replicaset.apps/grafana-b54bb57b9                      1         1         1       24m
istio-system           replicaset.apps/istio-egressgateway-64bc874f5c         1         1         1       24m
istio-system           replicaset.apps/istio-ingressgateway-6b947b8c5d        1         1         1       24m
istio-system           replicaset.apps/istio-tracing-9dd6c4f7c                1         1         1       24m
istio-system           replicaset.apps/istiod-654b4b468b                      1         1         1       24m
istio-system           replicaset.apps/kiali-d45468dc4                        1         1         1       24m
istio-system           replicaset.apps/prometheus-77566c9987                  1         1         1       24m
kube-system            replicaset.apps/calico-kube-controllers-578894d4cd     1         1         1       3h29m
kube-system            replicaset.apps/coredns-66bff467f8                     2         2         2       3h29m
kubernetes-dashboard   replicaset.apps/dashboard-metrics-scraper-6b4884c9d5   1         1         1       161m
kubernetes-dashboard   replicaset.apps/kubernetes-dashboard-7b544877d5        1         1         1       161m

Prometheus, Jaeger, Grafana, and Kiali in Kubernetes

Istio deploys the following software:

Prometheus

Scrapes and stores time series data using service discovery. It is used to record status data about every aspect of the Kubernetes Cluster nodes, Istio mesh, and deployments.

Jaeger

It is a distributed tracing system developed by Uber, it provides context propagation, transaction monitoring, service dependency, performance and latency analysis for distributed applications.

Grafana

Uses Prometheus as a data source to visualize different dashboards with metrics from the services deployed in the Kubernetes Cluster.

Kiali

Installing Istio in Kubernetes 1
Istio Kiali Console Showing the Response Time

Visualizes the service mesh topology in Kubernetes showing the status of the applications and its individual components and connections. It also provides an interface to edit Istio configuration objects, like virtual services.

Publish Prometheus, Jaeger, Grafana, and Kiali using a NodePort

To access the dashboards using a web browser from the client machine a proxy is needed as the services listen in a Cluster IP.

During development, a NodePort can be used to insecurely publish each service.

Create the file istio-services-node-port.yaml with the following content:

#Grafana
apiVersion: v1
kind: Service
metadata:
  labels:
    app: grafana
    release: istio
  name: grafana-np
  namespace: istio-system
spec:
  ports:
  - name: http
    nodePort: 32493
    port: 3000
    protocol: TCP
    targetPort: 3000
  selector:
    app: grafana
  sessionAffinity: None
  type: NodePort
---
#prometheus
apiVersion: v1
kind: Service
metadata:
  labels:
    app: prometheus
    release: istio
  name: prometheus-np
  namespace: istio-system
spec:
  ports:
  - name: http
    nodePort: 32494
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: prometheus
  sessionAffinity: None
  type: NodePort
---
#jaeger
apiVersion: v1
kind: Service
metadata:
  labels:
    app: jaeger
    release: istio
  name: tracing-np
  namespace: istio-system
spec:
  ports:
  - name: http-tracing
    nodePort: 32495
    port: 80
    protocol: TCP
    targetPort: 16686
  selector:
    app: jaeger
  sessionAffinity: None
  type: NodePort
---
#kiali
apiVersion: v1
kind: Service
metadata:
  labels:
    app: kiali
    release: istio
  name: kiali-np
  namespace: istio-system
spec:
  ports:
  - name: http-kiali
    nodePort: 32496
    port: 20001
    protocol: TCP
    targetPort: 20001
  selector:
    app: kiali
  sessionAffinity: None
  type: NodePort


Apply the file to the Kubernetes cluster:

$ kubectl apply -f istio-services-node-port.yaml 
service/grafana-np created
service/prometheus-np created
service/tracing-np created
service/kiali-np created

Access the services using a web browser:

Deploy the Bookinfo Istio Testing Application

Deploy the BookInfo Istio example application:

$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.6/samples/bookinfo/platform/kube/bookinfo.yaml
service/details created
serviceaccount/bookinfo-details created
deployment.apps/details-v1 created
service/ratings created
serviceaccount/bookinfo-ratings created
deployment.apps/ratings-v1 created
service/reviews created
serviceaccount/bookinfo-reviews created
deployment.apps/reviews-v1 created
deployment.apps/reviews-v2 created
deployment.apps/reviews-v3 created
service/productpage created
serviceaccount/bookinfo-productpage created
deployment.apps/productpage-v1 created

Use Istio for your service mesh microservices architecture

Other IT Wonder Lab tutorials explaining how to use Istio for traffic management:

How useful was this post?

Click on a star to rate it!

Average rating 4.9 / 5. Vote count: 394

No votes so far! Be the first to rate this post.

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?

0 0 vote
Article Rating
guest

This site uses Akismet to reduce spam. Learn how your comment data is processed.

8 Comments
Oldest
Newest Most Voted
Inline Feedbacks
View all comments
Boriphuth Saensukphattraka
Boriphuth Saensukphattraka
8 months ago

Please help I got some error

$ helm install install/kubernetes/helm/istio –name istio –namespace istio-system –set gateways.istio-ingressgateway.type=NodePort –set gateways.istio-egressgateway.type=NodePort –values install/kubernetes/helm/istio/values-istio-demo.yaml
Error: validation failed: unable to recognize “”: no matches for kind “Deployment” in version “extensions/v1beta1”

Boriphuth Saensukphattraka
Boriphuth Saensukphattraka
8 months ago
Reply to  Javier

Thank you for your reply I will try on this.

Boriphuth Saensukphattraka
Boriphuth Saensukphattraka
8 months ago
Reply to  Javier

It’s still error with this.
helm install install/kubernetes/helm/istio –name istio –namespace istio-system –set gateways.istio-ingressgateway.type=NodePort –set gateways.istio-egressgateway.type=NodePort –values install/kubernetes/helm/istio/values-istio-demo.yaml
Error: validation failed: [unable to recognize “”: no matches for kind “DestinationRule” in version “networking.istio.io/v1alpha3”, unable to recognize “”: no matches for kind “attributemanifest” in version “config.istio.io/v1alpha2”, unable to recognize “”: no matches for kind “handler” in version “config.istio.io/v1alpha2”, unable to recognize “”: no matches for kind “instance” in version “config.istio.io/v1alpha2”, unable to recognize “”: no matches for kind “rule” in version “config.istio.io/v1alpha2”]

Boriphuth Saensukphattraka
Boriphuth Saensukphattraka
8 months ago

After repeat the step again it’s work thank you

Bogdan Olteanu
Bogdan Olteanu
5 months ago
Reply to  Javier

Helm 3.0 is out which doesn’t use tiller anymore.

IT Wonder Lab - Best Practices for the Cloud

ansible-aws-ec2-terraform-tags - ansible-aws-ec2-terraform-tags-ec2.png
Ansible

How to use Ansible and Terraform together?

This Ansible AWS tutorial shows how to use Ansible and its dynamic inventory to provision the software and configuration of infrastructure that has been created with Terraform.