You're reading from Kubernetes – An Enterprise Guide - Second Edition

Product typeBook

Published inDec 2021

PublisherPackt

ISBN-139781803230030

Edition2nd Edition

Concepts

Cloud Computing

Authors (2):

Marc Boorshtein

Scott Surovich

View More author details

An Introduction to Istio

"If it makes it easier for users to use on the frontend, it's probably complex on the backend."

Istio is a large, complex system that provides benefits to your workloads by offering enhanced security, discovery, observability, traffic management, and more – all without requiring application developers to write modules or applications to handle each task.

For most people, it has a large learning curve, but once you have the Istio skills to deploy and operate a service mesh, you will be able to provide very complex offerings to your developers, including the ability to do the following:

Route traffic based on various requirements
Secure service-to-service communication
Traffic shaping
Circuit breaking
Service observability

Again, all of these can be used by developers with very little, or no, code changes. When something is simple for users to consume, it usually means the system has a...

Technical requirements

This chapter has the following technical requirements:

A Docker host installed using the steps from Chapter 1, Docker and Container Essentials, with a minimum of 8GB of RAM
A KinD cluster configured using the initial scripts from Chapter 2, Deploying Kubernetes Using KinD
Installation scripts from this book's GitHub repository

You can access the code for this chapter by going to this book's GitHub repository: https://github.com/PacktPublishing/Kubernetes---An-Enterprise-Guide-2E/tree/main/chapter12.

To use Istio to expose workloads, we will remove NGINX from the KinD cluster, which will allow Istio to utilize ports 80 and 443 on the host.

Why should you care about a service mesh?

Istio provides a number of features that, without it, would require a developer to create them from scratch and edit their code. If a developer had to create many of the features provided by Istio, they would need to create the code in all of the languages that they are developing in. Need encryption between your services that are written in Java, Python, or Node? You would need to create the code three times – once for each programming language. The same would be true for traffic management, or any of the other features that are provided out of the box by Istio.

So, what can Istio provide you that should make you consider deploying it?

Workload observability

Have you ever tried keeping track of services and finding where the issue is when you have 20, 30, or more services running in your application?

Using the observability and tracing ability provided by Istio and add-on components, you can find and resolve issues...

Introduction to Istio concepts

You can break down the concepts of Istio into 4 categories, traffic management, security, observability, and extensibility. Each of these concepts will introduce the components and custom resources that developers will use to leverage the advantages of using Istio.

Understanding the Istio components

Similar to a standard Kubernetes cluster, Istio refers to two separate planes, the control plane and the data plane. Historically, the data plane included 4 different services, Pilot, Galley, Citadel, and Mixer – all broken out in a true microservices design. This design was used for multiple reasons including the flexibility to break out the responsibilities to multiple teams, the ability to use different programming languages, and to scale each service independently of the others.

Istio has evolved quickly since its initial release. The team made the decision that breaking out the core services had little benefit, and in the end, made Istio more complex. This led the team to redesign Istio and starting with Istio 1.5, Istio includes the components that we will discuss in this section.

Making the Control Plane Simple with Istiod

Just as Kubernetes bundled multiple controllers into a single executable, the kube-controller-manager...

Installing Istio

There are multiple methods to deploy Istio. The most common method today is to use either istioctl or the Istio operator, but there are additional options depending on your organization. You may elect to use one of the alternative installation methods of creating manifests via istoctl or the Helm chart (which as of the time of writing is considered alpha).

A brief list of advantages and disadvantages for each method is detailed in Table 12.1: Istio deployment methods.

...

Introducing Istio resources

Once you deploy Istio, you will have additional custom resources that provide the Istio features. Each of these resources provides powerful features and each one could be a chapter by itself. In this section, we want to provide enough details so you will have a strong understanding of each object. In the next section, we will deploy a basic application that will explain many of the objects in a real-world application example.

Authorization policies

Authorization policies are used to control access to the deployments in the service mesh. They provide developers with the ability to control access to workloads based on actions including deny, allow, and custom.

Policies are applied in a certain order. Istio will apply custom policies first, then deny policies, and finally, any allow policies.

Understanding how a policy's actions are evaluated is very important, since a misconfigured policy may not provide the expected results. The high...

Deploying add-on components to provide observability

By now, you know how to deploy Istio and understand some of the most used objects, but you haven't seen one of the most useful features yet – observability. At the beginning of the chapter, we mentioned that observability was one of our favorite features provided by Istio, and in this chapter, we will explain how to deploy a popular Istio add-on called Kiali.

Installing Prometheus

Before we install Kiali, we need to deploy an open-source monitoring and alert component called Prometheus that was developed by SoundCloud to store our mesh metrics. Prometheus was developed in 2012 and in 2016 it was added to the Cloud Native Computing Foundation (CNCF), becoming only the second project in the CNCF behind Kubernetes.

People who are newer to Prometheus and Kubernetes often misunderstand the features provided by Prometheus. Prometheus does not provide logging for your containers or infrastructure, that's where...

Deploying an application into the service mesh

We could define the components and objects of Istio all day, but if you are like us, examples and use-cases are often more beneficial to understanding advanced concepts like the features provided by Istio. In this section, we will explain many of the custom resources in detail, providing examples that you can deploy in your KinD cluster.

Deploying your first application into the mesh

Finally! We have Istio and the add-on components installed and we can move on to installing a real application in the service mesh to verify everything is working.

For this section, we will deploy an example application from Google called the Boutique app. In the next chapter, we will deploy a different application and explain all of the details and communication between the services, but the Boutique app is a great application to test out the mesh before we get into that level of information.

To deploy Google's Boutique app, execute...

Summary

In this chapter, we introduced you to the service mesh world, using the popular open-source project Istio. In the first section of the chapter, we explained some of the advantages of using a service mesh, which included security and observability for mesh services.

The second section of the chapter detailed the installation of Istio and the different installation profiles that are available. We deployed Istio into our KinD clusters and we also removed NGNIX to free up ports 80 and 443 to be used by Istio's ingress gateway. This section also included the objects that are added to a cluster once you deploy Istio. We covered the most common objects using example manifests that reinforce how to use each object in your own deployments.

To close out the chapter, we detailed how to install Kiali, Prometheus, and Jaeger to provide powerful observability in our service mesh. We also explained how to use Kiali to look into an application in the mesh to view the application...

Questions

What Istio object(s) is used to route traffic between multiple versions of an application?
1. Ingress rule
2. VirtualService
3. DestinationRule
4. You can't route to multiple versions, only a single instance
Answer: b and c
What tool(s) are required to provide observability in the service mesh?
1. Prometheus
2. Jaeger
3. Kiali
4. Kubernetes dashboard
Answer: a and c
True or false: Istio features require developers to change their code to leverage features like mutual TLS and authorization.
1. True
2. False
Answer: False
Istio made the control plane easier to deploy and configure by merging multiple components into a single executable called:
1. Istio
2. IstioC
3. istiod
4. Pilot
Answer: c. istiod

Join our book's Discord space

Join the...

The rest of the chapter is locked

You have been reading a chapter from

Kubernetes – An Enterprise Guide - Second Edition

Published in: Dec 2021Publisher: PacktISBN-13: 9781803230030

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at €14.99/month. Cancel anytime

Authors (2)

Marc Boorshtein

Marc Boorshtein has been a software engineer and consultant for 20 years and is currently the CTO (Chief Technology Officer) of Tremolo Security, Inc. Marc has spent most of his career building identity management solutions for large enterprises, U.S. Government civilian agencies, and local government public safety systems.
Read more about Marc Boorshtein

Scott Surovich

Scott Surovich has been involved in the industry for over 25 years and is currently the Global Container Engineering Lead at a tier 1 bank as the Global on-premises Kubernetes product owner architecting and, delivering cluster standards, including the surrounding ecosystem. His previous roles include working on other global engineering teams, including Windows, Linux, and virtualization.
Read more about Scott Surovich

Personalised recommendations for you

Based on your interests and search pattern

Designing and Implementing Microsoft Azure Networking Solutions

Designing and Implementing Microsoft Azure Networking Solutions Exam Ref AZ-700 is an all-encompassing guide to the AZ-700 exam and contains all the information you need to succeed in the world of virtual networking with Azure. With this book, you will be fully prepared for the exam and the world of cloud networking.

BookAug 2023524 pages

Microsoft 365 Security, Compliance, and Identity Administration

The Microsoft 365 Security, Compliance, and Identity Administration is a comprehensive guide that helps you employ Microsoft 365's robust suite of features and empowers you to optimize your administrative tasks.

BookAug 2023630 pages

Zero Trust Overview and Playbook Introduction

Get started on Zero Trust with this step-by-step playbook and learn everything you need to know for a successful Zero Trust journey with tailored guidance for every role, covering strategy, operations, architecture, implementation, and measuring success. This book will become an indispensable reference for everyone in your organization.

BookOct 2023240 pages

The Self-Taught Cloud Computing Engineer

This self-study book helps you master multiple clouds, including AWS, Azure, and GCP, and serves as a roadmap to becoming a certified cloud computing expert. The book will guide you to develop a professional cloud career by helping you build a broad cloud knowledge base, developing hands-on cloud computing skills, and getting cloud certified.

BookSep 2023472 pages

Technology Operating Models for Cloud and Edge

This book will help you build and create ownership of a technology operating model, as well as connect your leadership with engineering and operations, keeping your internal and external customers in mind. It provides practical tips on why, where, and how to make the cloud and edge platform paradigm sing for you, your team, and your organization.

BookAug 2023228 pages

Azure Architecture Explained

Azure is the preferred platform to build mission-critical and secure apps. This book provides comprehensive coverage of essential Azure products, services, and solutions vital for every solution architect's success. Elevate your knowledge and master the critical components of Azure to excel in your role with Azure Architecture Explained.

BookSep 2023446 pages

Pentesting Active Directory and Windows-based Infrastructure

This practical guide helps you explore the pentesting of Microsoft infrastructure in detail, and enhances your offensive skillset by showing you the different ways to perform security assessment. This book will help blue teamers and IT engineers get up to speed with possible security issues they may encounter in their Windows environments.

BookNov 2023360 pages

Practical Ansible

In Practical Ansible, you'll work with the latest release of Ansible and learn to solve complex issues quickly with the help of task-oriented scenarios. You'll start by installing and configuring Ansible to automate monotonous and repetitive IT tasks and get to grips with concepts such as playbooks, inventories, plugins, collections, and network modules.

BookSep 2023420 pages

Windows 11 for Enterprise Administrators

Microsoft’s launch of Windows 11 is a step toward satisfying the enterprise administrator’s needs for better management and enhanced user experience customization. This book provides the enterprise administrator with the knowledge needed to fully utilize the advanced feature set of Windows 11 Enterprise.

BookOct 2023286 pages

The Linux DevOps Handbook

This book is for software and IT professionals seeking knowledge on Linux systems and DevOps practices. This book will provide you with guidance and tools to learn and gain proficiency in managing Linux-based infrastructures and knowledge of DevOps.

BookNov 2023428 pages2

Deployment method	Advantages	Disadvantages
istioctl	Configuration validation and health checks Does not require any privileged pods, increasing cluster security Multiple configuration options