Installing Istio for Knative

    If your cloud platform offers a managed Istio installation, we recommend installing Istio that way, unless you need to customize your installation.

    You need:

    • A Kubernetes cluster created.
    • installed.

    Supported Istio versions

    You can view the latest tested Istio version on the .

    When you install Istio, there are a few options depending on your goals. For a basic Istio installation suitable for most Knative use cases, follow the instructions. If you’re familiar with Istio and know what kind of installation you want, read through the options and choose the installation that suits your needs.

    You can easily customize your Istio installation with istioctl. The following sections cover a few useful Istio configurations and their benefits.

    You can install Istio with or without a service mesh:

    If you want to get up and running with Knative quickly, we recommend installing Istio without automatic sidecar injection. This install is also recommended for users who don’t need the Istio service mesh, or who want to enable the service mesh by .

    Installing Istio without sidecar injection

    Enter the following command to install Istio:

    To install Istio without sidecar injection:

    Installing Istio with sidecar injection

    If you want to enable the Istio service mesh, you must enable automatic sidecar injection. The Istio service mesh provides a few benefits:

    For automatic sidecar injection, set autoInject: enabled in addition to the earlier operator configuration.

    1.     global:
    2.       proxy:
    3.         autoInject: enabled

    Using Istio mTLS feature

    Since there are some networking communications between knative-serving namespace and the namespace where your services running on, you need additional preparations for mTLS enabled environment.

    1. Enable sidecar container on knative-serving system namespace.

      1. kubectl label namespace knative-serving istio-injection=enabled

    2. Set PeerAuthentication to PERMISSIVE on knative-serving system namespace by creating a YAML file using the following template:

      1. apiVersion: "security.istio.io/v1beta1"
      2. kind: "PeerAuthentication"
      3. metadata:
      4.   name: "default"
      5.   namespace: "knative-serving"
      6. spec:
      7.   mtls:
      8.     mode: PERMISSIVE

    3. Apply the YAML file by running the command:

      Where <filename> is the name of the file you created in the previous step.

    After you install the cluster local gateway, your service and deployment for the local gateway is named knative-local-gateway.

    If you create a custom service and deployment for local gateway with a name other than knative-local-gateway, you need to update gateway configmap config-istio under the knative-serving namespace.

    1. Edit the config-istio configmap:

      1. kubectl edit configmap config-istio -n knative-serving

    2. Replace the local-gateway.knative-serving.knative-local-gateway field with the custom service. As an example, if you name both the service and deployment custom-local-gateway under the namespace istio-system, it should be updated to:

      As an example, if both the custom service and deployment are labeled with custom: custom-local-gateway, not the default istio: knative-local-gateway, you must update gateway instance knative-local-gateway in the knative-serving namespace:

      1. kubectl edit gateway knative-local-gateway -n knative-serving

      For the service mentioned earlier, it should be updated to:

      1. custom: custom-local-gateway

      If there is a change in service ports (compared to that of knative-local-gateway), update the port info in the gateway accordingly.

      View the status of your Istio installation to make sure the install was successful. It might take a few seconds, so rerun the following command until all of the pods show a STATUS of Running or Completed:

      Tip

      You can append the --watch flag to the kubectl get commands to view the pod status in realtime. You use CTRL + C to exit watch mode.

      Knative dispatches to different services based on their hostname, so it is recommended to have DNS properly configured.

      To do this, begin by looking up the external IP address that Istio received:

      1. $ kubectl get svc -nistio-system
      2. NAME                    TYPE           CLUSTER-IP   EXTERNAL-IP    PORT(S)                                      AGE
      3. istio-ingressgateway    LoadBalancer   10.0.2.24    34.83.80.117   15020:32206/TCP,80:30742/TCP,443:30996/TCP   2m14s
      4. istio-pilot             ClusterIP      10.0.3.27    <none>         15010/TCP,15011/TCP,8080/TCP,15014/TCP       2m14s

      This external IP can be used with your DNS provider with a wildcard A record. However, for a basic non-production set up, this external IP address can be used with sslip.io in the config-domain ConfigMap in knative-serving.

      You can edit this by using the following command:

      Given this external IP, change the content to:

      1. apiVersion: v1
      2. kind: ConfigMap
      3. metadata:
      4.   name: config-domain
      5.   namespace: knative-serving
      6. data:
      7.   # sslip.io is a "magic" DNS provider, which resolves all DNS lookups for:
      8.   # *.{ip}.sslip.io to {ip}.

      Istio resources

      What’s next