| apiVersion: operator.istio.io/v1alpha1 | |
| kind: IstioOperator | |
| metadata: | |
| name: istio | |
| spec: | |
| revision: alt | |
| components: | |
| ingressGateways: | |
| - name: istio-ingressgateway | |
| enabled: true |
| #!/usr/bin/env bash | |
| # This script determines how applications in the mesh and exposed by a Service bind. | |
| # Dependencies on host: kubectl, istioctl, jq. | |
| # Dependencies on mesh: distroless is not supported, ipv6 untested. This script supports only Istio 1.8.1+. | |
| # This will `exec` into the proxy, but only run ss, so it should be suitable to run in a live cluster. | |
| # | |
| # In Istio 1.9, localhost and wildcard binds are supported out of the box. A bind to POD_IP can be enabled | |
| # with a custom Sidecar. | |
| # In future versions of Istio, we may change this to support wildcard and POD_IP binds out of the box, and |
| # Fetch a token. Only needed for JWT auth. Replace SA or namespace if needed | |
| token=$(echo '{"kind":"TokenRequest","apiVersion":"authentication.k8s.io/v1","spec":{"audiences":["istio-ca"], "expirationSeconds":2592000}}' | kubectl create --raw /api/v1/namespaces/default/serviceaccounts/default/token -f - | jq -j '.status.token') | |
| # Fetch request | |
| request=$(cat request.json ) | |
| # JWT authentication | |
| echo "${request}" | grpcurl -d @ -insecure -rpc-header "authorization: Bearer $token" localhost:15012 envoy.service.discovery.v3.AggregatedDiscoveryService/StreamAggregatedResources | |
| # Plaintext Authentication | |
| # echo "${request}" | grpcurl -v -d @ -plaintext localhost:15010 envoy.service.discovery.v3.AggregatedDiscoveryService/StreamAggregatedResources |
| # Build just the minimal dependencies we need | |
| # Note: multiple builds are fast, so its fine to call this every time we run. Do not use `go run` - no caching. | |
| alias build-local='go build -o ./out/linux_amd64/release ./pilot/cmd/pilot-agent ./pilot/cmd/pilot-discovery' | |
| # Run pilot. Will use your local kubeconfig, or override with --kubeconfig flag | |
| alias pilot-local='build-local && ./out/linux_amd64/release/pilot-discovery discovery' | |
| # Fetch bootstrap token and root cert | |
| function proxy-local-bootstrap() { | |
| mkdir -p ./var/run/secrets/tokens ./var/run/secrets/istio |
| mkdir -p ./var/run/secrets/tokens ./var/run/secrets/istio | |
| echo '{"kind":"TokenRequest","apiVersion":"authentication.k8s.io/v1","spec":{"audiences":["istio-ca"]}}' | kubectl create --raw /api/v1/namespaces/default/serviceaccounts/default/token -f - | jq -j '.status.token' > ./var/run/secrets/tokens/istio-token | |
| kubectl -n istio-system get secret istio-ca-secret -ojsonpath='{.data.ca-cert\.pem}' | base64 -d > ./var/run/secrets/istio/root-cert.pem | |
| CA_ADDR=localhost:15012 PROXY_CONFIG="$(cat proxyconfig.yaml | envsubst)" go run ./pilot/cmd/pilot-agent proxy sidecar --templateFile ./tools/packaging/common/envoy_bootstrap_v2.json | |
| where proxyconfig.yaml: | |
| binaryPath: $GOPATH/src/istio.io/istio/out/linux_amd64/release/envoy | |
| configPath: $HOME/kube/local/proxy | |
| discoveryAddress: localhost:15012 | |
| statusPort: 15020 |
Example remote control plane setup. Workloads connect to a gateway exposed under istiod.howardjohn-mc.qualistio.org, which has a real LetsEncrypt certificate.
istioctl install -d manifests
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.0/cert-manager.yaml
kubectl apply -f controlplane.yaml
The goal of this is to make revision transparent to user. Rather than specifying a revision as part of the pod/namespace, we will do routing at a gateway based on some metadata. For this example we will user an arbitrary setting we configure on the pod - in practice we would likely use something like ISTIO_VERSION which is configured automatically for the user.
To deploy this, add the following annotation to a pod:
annotations:
proxy.istio.io/config: |
discoveryAddress: istio-ingressgateway.istio-system.svc:443
| # First define a basic deployment+service that will act as our local service | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: httpbin | |
| namespace: default | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: httpbin |