Ingress Gateways

    This task describes how to configure Istio to expose a service outside of the service mesh using an Istio Gateway.

    • Setup Istio by following the instructions in the .

    • Make sure your current directory is the istio directory.

    • Start the httpbin sample.

      If you have enabled , deploy the httpbin service:

      Zip

      Otherwise, you have to manually inject the sidecar before deploying the httpbin application:

      1. $ kubectl apply -f <(istioctl kube-inject -f @samples/httpbin/httpbin.yaml@)

    • Determine the ingress IP and ports as described in the following subsection.

    Execute the following command to determine if your Kubernetes cluster is running in an environment that supports external load balancers:

    1. $ kubectl get svc istio-ingressgateway -n istio-system
    2. NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP      PORT(S)   AGE
    3. istio-ingressgateway   LoadBalancer   172.21.109.129   130.211.10.121   ...       17h

    If the EXTERNAL-IP value is set, your environment has an external load balancer that you can use for the ingress gateway. If the EXTERNAL-IP value is <none> (or perpetually <pending>), your environment does not provide an external load balancer for the ingress gateway. In this case, you can access the gateway using the service’s .

    If you are using minikube, you can easily start an external load balancer (recommended) by running the following command in a different terminal:

    1. $ minikube tunnel

    Choose the instructions corresponding to your environment:

    Follow these instructions if you have determined that your environment has an external load balancer.

    1. $ export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
    2. $ export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}')
    3. $ export SECURE_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].port}')
    4. $ export TCP_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="tcp")].port}')

    In certain environments, the load balancer may be exposed using a host name, instead of an IP address. In this case, the ingress gateway’s EXTERNAL-IP value will not be an IP address, but rather a host name, and the above command will have failed to set the INGRESS_HOST environment variable. Use the following command to correct the INGRESS_HOST value:

    1. $ export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

    Follow these instructions if you have determined that your environment does not have an external load balancer, so you need to use a node port instead.

    Set the ingress ports:

    1. $ export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
    2. $ export SECURE_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].nodePort}')
    3. $ export TCP_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="tcp")].nodePort}')

    Setting the ingress IP depends on the cluster provider:

    1. GKE:

    1. You need to create firewall rules to allow the TCP traffic to the _ingressgateway_ service's ports.
    2. Run the following commands to allow the traffic for the HTTP port, the secure port (HTTPS) or both:
    4. <pre><code class='language-bash' data-expandlinks='true' data-repo='istio' >$ gcloud compute firewall-rules create allow-gateway-http --allow &#34;tcp:$INGRESS_PORT&#34;

    $ gcloud compute firewall-rules create allow-gateway-https –allow “tcp:$SECURE_INGRESS_PORT”

    1. IBM Cloud Kubernetes Service:

      1. $ ibmcloud ks workers --cluster cluster-name-or-id

    $ export INGRESS_HOST=public-IP-of-one-of-the-worker-nodes

    1. Docker For Desktop:

      1. $ export INGRESS_HOST=127.0.0.1

    2. Other environments:

      1. $ export INGRESS_HOST=$(kubectl get po -l istio=ingressgateway -n istio-system -o jsonpath='{.items[0].status.hostIP}')

    Configuring ingress using an Istio gateway

    An ingress describes a load balancer operating at the edge of the mesh that receives incoming HTTP/TCP connections. It configures exposed ports, protocols, etc. but, unlike Kubernetes Ingress Resources, does not include any traffic routing configuration. Traffic routing for ingress traffic is instead configured using Istio routing rules, exactly in the same way as for internal service requests.

    Let’s see how you can configure a Gateway on port 80 for HTTP traffic.

    1. Create an Istio Gateway:

      1. $ kubectl apply -f - <<EOF
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: httpbin-gateway
      6.   selector:
      7.     istio: ingressgateway # use Istio default gateway implementation
      8.   servers:
      9.   - port:
      10.       number: 80
      12.       protocol: HTTP
      13.     hosts:
      14.     - "httpbin.example.com"
      15. EOF

    2. Configure routes for traffic entering via the Gateway:

      1. $ kubectl apply -f - <<EOF
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: VirtualService
      4. metadata:
      5.   name: httpbin
      6. spec:
      7.   hosts:
      8.   - "httpbin.example.com"
      9.   gateways:
      10.   - httpbin-gateway
      11.   http:
      12.   - match:
      13.     - uri:
      14.         prefix: /status
      15.     - uri:
      16.         prefix: /delay
      17.     route:
      18.     - destination:
      19.         port:
      20.           number: 8000
      21.         host: httpbin
      22. EOF

      The list specifies that only requests through your httpbin-gateway are allowed. All other external requests will be rejected with a 404 response.

      Internal requests from other services in the mesh are not subject to these rules but instead will default to round-robin routing. To apply these rules to internal calls as well, you can add the special value mesh to the list of gateways. Since the internal hostname for the service is probably different (e.g., httpbin.default.svc.cluster.local) from the external one, you will also need to add it to the hosts list. Refer to the operations guide for more details.

    3. Access the httpbin service using curl:

      Note that you use the -H flag to set the Host HTTP header to “httpbin.example.com”. This is needed because your ingress Gateway is configured to handle “httpbin.example.com”, but in your test environment you have no DNS binding for that host and are simply sending your request to the ingress IP.

    4. Access any other URL that has not been explicitly exposed. You should see an HTTP 404 error:

      1. $ curl -s -I -HHost:httpbin.example.com "http://$INGRESS_HOST:$INGRESS_PORT/headers"
      2. HTTP/1.1 404 Not Found
      3. ...

    Entering the httpbin service URL in a browser won’t work because you can’t pass the Host header to a browser like you did with curl. In a real world situation, this is not a problem because you configure the requested host properly and DNS resolvable. Thus, you use the host’s domain name in the URL, for example, https://httpbin.example.com/status/200.

    To work around this problem for simple tests and demos, use a wildcard * value for the host in the Gateway and VirtualService configurations. For example, if you change your ingress configuration to the following:

    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: Gateway
    4.   name: httpbin-gateway
    5. spec:
    6.   selector:
    7.     istio: ingressgateway # use Istio default gateway implementation
    8.   servers:
    9.   - port:
    10.       number: 80
    11.       name: http
    12.       protocol: HTTP
    13.     hosts:
    14.     - "*"
    15. ---
    16. apiVersion: networking.istio.io/v1alpha3
    17. kind: VirtualService
    18. metadata:
    19.   name: httpbin
    20. spec:
    21.   hosts:
    22.   - "*"
    23.   gateways:
    24.   - httpbin-gateway
    25.   http:
    26.   - match:
    27.     - uri:
    28.         prefix: /headers
    29.     route:
    30.     - destination:
    31.         port:
    32.           number: 8000
    33.         host: httpbin
    34. EOF

    You can then use $INGRESS_HOST:$INGRESS_PORT in the browser URL. For example, http://$INGRESS_HOST:$INGRESS_PORT/headers will display all the headers that your browser sends.

    Understanding what happened

    The Gateway configuration resources allow external traffic to enter the Istio service mesh and make the traffic management and policy features of Istio available for edge services.

    In the preceding steps, you created a service inside the service mesh and exposed an HTTP endpoint of the service to external traffic.

    1. Inspect the values of the INGRESS_HOST and INGRESS_PORT environment variables. Make sure they have valid values, according to the output of the following commands:

      1. $ kubectl get svc -n istio-system
      2. $ echo "INGRESS_HOST=$INGRESS_HOST, INGRESS_PORT=$INGRESS_PORT"

    2. Check that you have no other Istio ingress gateways defined on the same port:

      1. $ kubectl get gateway --all-namespaces

    3. Check that you have no Kubernetes Ingress resources defined on the same IP and port:

      1. $ kubectl get ingress --all-namespaces

    4. If you have an external load balancer and it does not work for you, try to access the gateway using its node port.

    Cleanup

    Zip

    1. $ kubectl delete gateway httpbin-gateway