Install Gloo Mesh Istio

Install Gloo Mesh Istio, a hardened Istio enterprise image, in your remote clusters.

About Gloo Mesh Istio

Gloo Mesh Istio is a hardened Istio enterprise image to maintain n-4 support for CVEs and other security fixes longer than the community Istio, which provides n-1 support with an additional 6 weeks of extended time to upgrade the n-2 version to n-1. Based on a cadence of 1 release every 3 months, Gloo Mesh's n-4 support provides an extra 9 months to run the hardened Istio version of your choice, compared to an open source strategy that also lacks enterprise support. Note that all backported functionality is available in the upstream community Istio, as there are no proprietary features or forked capabilities from community Istio.

Solo provides two main distributions for Gloo Mesh Istio as follows.

Additionally, the standard and solo distributions of Istio come in several varieties as follows.

To use the FIPS distribution, check out Install Gloo Mesh Istio FIPS. To use a specific version of a distribution, see Get the Gloo Mesh Istio version that you want to use.

Installing Gloo Mesh Istio

Before you begin:

To install Gloo Mesh Istio:

  1. Install Istio in each remote cluster that you want to register with Gloo Mesh.

    • Production use case: In a typical production setup, you do not install Istio in the management cluster.
    • Testing or proof of concept use case: You can install Istio in the management cluster if the cluster also operates as a data plane for your service mesh.
    • Image: In the following Istio Operator resource, the hub value must be gcr.io/istio-enterprise, and the tag value is the desired image of Gloo Mesh Istio. An image might be tagged to meet multiple use cases, such as 1.10.4-solo-distroless.
    • Version 1.8 and later: Note that the IstioOperator manifest for Istio 1.8 and later is different than Istio 1.7.
    
       cat << EOF | istioctl manifest install -y -f -
       apiVersion: install.istio.io/v1alpha1
       kind: IstioOperator
       metadata:
         name: gloo-mesh-istio
         namespace: istio-system
       spec:
         # This value is required for Gloo Mesh Istio
         hub: gcr.io/istio-enterprise
         # This value can be any Gloo Mesh Istio tag
         tag: 1.10.4
         profile: minimal
         meshConfig:
           enableAutoMtls: true
           defaultConfig:
             proxyMetadata:
               # Enable Istio agent to handle DNS requests for known hosts
               # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
               ISTIO_META_DNS_CAPTURE: "true"
         components:
           # Istio Gateway feature
           ingressGateways:
           - name: istio-ingressgateway
             enabled: true
             k8s:
               env:
                 - name: ISTIO_META_ROUTER_MODE
                   value: "sni-dnat"
               service:
                 type: LoadBalancer
                 ports:
                   - port: 80
                     targetPort: 8080
                     name: http2
                   - port: 443
                     targetPort: 8443
                     name: https
                   - port: 15443
                     targetPort: 15443
                     name: tls
         values:
           global:
             pilotCertProvider: istiod
       EOF
       
    
       cat << EOF | istioctl manifest install -f -
       apiVersion: install.istio.io/v1alpha1
       kind: IstioOperator
       metadata:
         name: gloo-mesh-istio
         namespace: istio-system
       spec:
         # This value is required for Gloo Mesh Istio
         hub: gcr.io/istio-enterprise
         # This value can be any Gloo Mesh Istio tag
         tag: 1.7.5-fips2
         profile: minimal
         addonComponents:
           istiocoredns:
             enabled: true
         components:
           # Istio Gateway feature
           ingressGateways:
             - name: istio-ingressgateway
               enabled: true
               k8s:
                 env:
                   - name: ISTIO_META_ROUTER_MODE
                     value: "sni-dnat"
                 service:
                   ports:
                     - port: 80
                       targetPort: 8080
                       name: http2
                     - port: 443
                       targetPort: 8443
                       name: https
                     - port: 15443
                       targetPort: 15443
                       name: tls
         meshConfig:
           enableAutoMtls: true
         values:
           prometheus:
             enabled: false
           gateways:
             istio-ingressgateway:
               type: NodePort
               ports:
                 - targetPort: 15443
                   name: tls
                   nodePort: 32000
                   port: 15443
           global:
             pilotCertProvider: istiod
             controlPlaneSecurityEnabled: true
             podDNSSearchNamespaces:
               - global
    
       EOF
       
  2. After the installation is complete, verify that the Istio control plane pods are running in each cluster.

    kubectl get pods -n istio-system --context $REMOTE_CONTEXT_1
    

    Example output:

    NAME                                    READY   STATUS    RESTARTS   AGE
    istio-ingressgateway-746d597f7c-g6whv   1/1     Running   0          5d23h
    istiod-7795ccf9dc-vr4cq                 1/1     Running   0          5d22h
    
  3. Optional: Verify that the Istio control plane pods run the Istio version that you chose.

    kubectl get pods -n istio-system --context $REMOTE_CONTEXT_1 -o=jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}'
    

    Example output:

    istio-ingressgateway-ff54575c8-97c67:	gcr.io/istio-enterprise/proxyv2:1.10.4,
    istiod-5fbb57854-9pl28:	gcr.io/istio-enterprise/pilot:1.10.4,
    

Next steps

Now that Istio service meshes are installed, you can install the Gloo Mesh Enterprise management plane components into a cluster.