Using Istio to support Service Mesh on Multiple Alibaba Cloud Kubernetes Clusters

An important objective of Istio is to support the hybrid environment. For example, services can run on the Alibaba Cloud Container Service, a local Kubernetes cluster, or other services of the public cloud.Istio can provide a uniform view for the entire service platform, manage connections between these environments, and ensure security of these connections.The Istio multi-cluster feature allows you to add multiple Kubernetes to a single mesh and enable the service discovery function across clusters.According to the official introduction, Istio will also support global cluster-level load balancing and non-flat networks through gateway equivalent interconnection.

This article uses an example to describe how Alibaba Cloud Container Service implements application and service hybrid orchestration in multiple Kubernetes clusters based on Istio.You will see that after the Istio control plane is installed in a Kubernetes cluster and Istio is connected to two Kubernetes clusters, a mesh network is generated across multiple Kubernetes clusters.

Image for post
Image for post

Prepare the Kubernetes Clusters

Alibaba Cloud Container Service for Kubernetes V1.10.4 has been released. You can use the container service console to conveniently and quickly create a Kubernetes cluster.For more information about the process, see create a Kubernetes cluster.

Install and configure kubectl. Ensure that kubectl can connect to the Kubernetes clusters and the following network requirements are met:

  1. The pod CIDR range and service CIDR range of each cluster must be unique and cannot overlap with each other.
  2. All pod CIDRs in every cluster must be routable to each other.
  3. All Kubernetes control plane API servers must be routable to each other.

You can obtain files involved in this example by clicking here.

Remote Cluster Configuration

The Istio control plane needs to access all clusters in the mesh to implement service discovery.The following describes how to create a service account in the remote cluster and grant it essential RBAC permissions. Later, the credential of this service account will be used to generate a kubeconfig file. In this way, the remote cluster can be accessed.

The following process should be executed in every cluster to be added to the service mesh.This process must be completed by the administrator of each cluster.Run the generate-kubeconfig.sh command. The parameter is the unique identifier that describes the related cluster.

After these steps are completed, the kubeconfig file of the remote cluster is created in the current directory.The file name of the cluster is consistent with the cluster name in the original kubeconfig file.

Control Plane Cluster Configuration

In the cluster that runs the Istio control plane, create a secret for each remote cluster:

Install the Istio Control Plane

You can use the application catalog to conveniently deploy Istio.Click App Catalog on the left-side navigation bar, and select ack-istio on the right side. On the displayed page,select the namespace istio-system, and click Parameters to modify parameter settings for custom installation.

Note: This document provides important information for installation and uninstallation, especially frequently-seen custom resource definition (CRD) version problems.

Image for post
Image for post

Install the Istio Remote Component

Run the following script to obtain the connection information of the control plane:

Click App Catalog on the left-side navigation bar, and select ack-istio-remote on the right side. On the displayed page,select the namespace istio-system, and click Parameters to modify parameter settings based on the obtained information for custom installation.

Install the Example in the Cluster Istio-control-plane

Use the following command line or console to create a namespace bookinfo, and deploy the modified application.In the modified version, the details component is deleted, and ingressgateway is defined.

You can obtain files involved in this example by clicking here.

For the deployment modified based on the official example, the details component runs in the Kubernetes cluster Istio-control-plane that is installed on the Istio local control plane, and the details component runs in another Kubernetes cluster Istio-remote-1.

Image for post
Image for post

After the application runs normally, use the address exposed by ingressgateway to visit the /productpage page. The page should look similar to the following figure, where the details part cannot be displayed normally. This is because the details component is not installed in the cluster Istio-remote-1 and added to the same mesh yet.

Image for post
Image for post

Install the Example in the Cluster Istio-remote-1

Use the same method to install the details part of the example application in the cluster Istio-remote-1. You can obtain the YAML file by clicking here.

Then, the details service is registered on the control plane. You can check whether the response of {pilot-ipAddress}:8080/v1/registration contains the details service:

Image for post
Image for post

Visit the /productpage page again. The page should look similar to the following figure, where the details part should be displayed normally:

Image for post
Image for post

Summary

This article uses an official example to describe how Alibaba Cloud Container Service implements application and service hybrid orchestration in multiple Kubernetes clusters based on Istio.You will see that after the Istio control plane is installed in a Kubernetes cluster and Istio is connected to two Kubernetes clusters, a mesh network is generated across multiple Kubernetes clusters.

You are welcome to use Alibaba Cloud Container Service for Kubernetes to quickly build an Istio open platform and integrate Istio to microservice development in your project.

Reference:

https://www.alibabacloud.com/blog/using-istio-to-support-service-mesh-on-multiple-alibaba-cloud-kubernetes-clusters_593913?spm=a2c4.12014617.0.0

Written by

Follow me to keep abreast with the latest technology news, industry insights, and developer trends.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store