Istio service mesh
Use your Gloo Gateway proxy as the ingress gateway to control and secure traffic that enters your service mesh.
About service mesh
A service mesh is a dedicated infrastructure layer that you add your apps to that ensures secure service-to-service commnication across cloud networks. With a service mesh, you can solve problems, such as service identity, mutual TLS communication, consistent L7 network telemetry gathering, service resilience, secure traffic routing between services across clusters, and policy enforcement, such as to enforce quotas or rate limit requests. To learn more about the benefits of using a service mesh, see What is a service mesh in the Gloo Mesh Enterprise documentation.
About Istio
The open source project Istio is the leading service mesh implementation that offers powerful features to secure, control, connect, and monitor cloud-native, distributed applications. Istio is designed for workloads that run in one or more Kubernetes clusters, but you can also extend your service mesh to include virtual machines and other endpoints that are hosted outside your cluster. The key benefits of Istio include:
- Automatic load balancing for HTTP, gRPC, WebSocket, MongoDB, and TCP traffic
- Secure TLS encryption for service-to-service communication with identity-based authentication and authorization
- Advanced routing and traffic management policies, such as retries, failovers, and fault injection
- Fine-grained access control and quotas
- Automatic logs, metrics, and traces for traffic in the service mesh
About the Gloo Gateway Istio integration
Gloo Gateway comes with an Istio integration that allows you to configure your gateway proxy with an Istio sidecar. The Istio sidecar uses mutual TLS (mTLS) to prove its identity and to secure the connection between your gateway and the services in your Istio service mesh. In addition, you can control and secure the traffic that enters the mesh by applying all the advanced routing, traffic management, security, resiliency, and AI capabilities that Gloo Gateway offers. For example, you can set up end-user authentication and authorization, per-user rate limiting quotas, web application filters, and access logging to help prevent malicious attacks and audit service mesh usage.
Before you begin
Follow the Get started guide to install Gloo Gateway, set up a gateway resource, and deploy the httpbin sample app.
Get the external address of the gateway and save it in an environment variable.
Set up an Istio service mesh
Use Solo.io’s Gloo Mesh Enterprise product to install a managed Istio version by using the built-in Istio lifecycle manager, or manually install and manage your own Istio installation.
Enable the Istio integration in Gloo Gateway
Upgrade your Gloo Gateway installation to enable the Istio integration.
Get the name of the istiod service. Depending on how you set up Istio, you might see a revisionless service name (
istiod
) or a service name with a revision, such asistiod-1-21
.kubectl get services -n istio-system
Example output:
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE istiod-1-21 ClusterIP 10.102.24.31 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP 3h49m
Derive the Kubernetes service address for your istiod deployment. The service address uses the format
<service-name>.<namespace>.svc:15012
. For example, if your service name isistiod-1-21
, the full service address isistiod-1-21.istio-system.svc:15012
.Get the Helm values for your current Gloo Gateway installation.
helm get values gloo-gateway -n gloo-system -o yaml > gloo-gateway.yaml open gloo-gateway.yaml
Add the following values to the Helm value file. Make sure that you change the
istioProxyContainer
values to the service address and cluster name of your Istio installation.Setting Description istioDiscoveryAddress
The address of the istiod service. If omitted, istiod.istio-system.svc:15012
is used.istioMetaClusterId
istioMetaMeshId
The name of the cluster where Gloo Gateway is installed. Upgrade your Gloo Gateway installation.
Verify that your
gloo-proxy-http
pod is restarted with 3 containers now,gateway-proxy
,istio-proxy
, andsds
.kubectl get pods -n gloo-system | grep gloo-proxy-http
Example output:
gloo-proxy-http-f7cd596b7-tv5z7 3/3 Running 0 3h31m
Set up mTLS routing to httpbin
Label the httpbin namespace for Istio sidecar injection.
export REVISION=$(kubectl get pod -L app=istiod -n istio-system -o jsonpath='{.items[0].metadata.labels.istio\.io/rev}') echo $REVISION kubectl label ns httpbin istio.io/rev=$REVISION --overwrite=true
Perform a rollout restart for the httpbin deployment so that an Istio sidecar is added to the httpbin app.
kubectl rollout restart deployment httpbin -n httpbin
Verify that the httpbin app comes up with an additional (4th) container.
kubectl get pods -n httpbin
Example output:
NAME READY STATUS RESTARTS AGE httpbin-f46cc8b9b-f4wbm 4/4 Running 0 10s
Send a request to the httpbin app. Verify that you back a 200 HTTP response and that an
x-forwarded-client-cert
header is returned. The presence of this header indicates that the connection from the gateway to the httpbin app is now encrypted with mutual TLS.Example output:
{ "headers": { "Accept": [ "*/*" ], "Host": [ "www.example.com:8080" ], "User-Agent": [ "curl/7.77.0" ], "X-B3-Sampled": [ "0" ], "X-B3-Spanid": [ "92744e97e79d8f22" ], "X-B3-Traceid": [ "8189f0a6c4e3582792744e97e79d8f22" ], "X-Forwarded-Client-Cert": [ "By=spiffe://gloo-edge-docs-mgt/ns/httpbin/sa/httpbin;Hash=3a57f9d8fddea59614b4ade84fcc186edeffb47794c06608068a3553e811bdfe;Subject=\"\";URI=spiffe://gloo-edge-docs-mgt/ns/gloo-system/sa/gloo-proxy-http" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "7f1d6e38-3bf7-44fd-8298-a77c34e5b865" ] } }
Cleanup
You can optionally remove the resources that you created.
Follow the Uninstall guide in the Gloo Mesh Enterprise documentation to remove Gloo Mesh Enterprise.
Follow the upgrade guide to upgrade your Gloo Gateway Helm installation values. Remove the Helm values that you added as part of this guide.
Remove the Istio sidecar from the httpbin app.
Remove the Istio label from the httpbin namespace.
kubectl label ns httpbin istio.io/rev-
Perform a rollout restart for the httpbin deployment.
kubectl rollout restart deployment httpbin -n httpbin
Verify that the Istio sidecar container is removed.
kubectl get pods -n httpbin
Example output:
NAME READY STATUS RESTARTS AGE httpbin-7d4965fb6d-mslx2 3/3 Running 0 6s