Kubernetes with Istio demo

Build Status

GitBook version

Full asciinema demo can be found here: https://asciinema.org/a/226632

Slides: https://slides.com/ruzickap/k8s-istio-demo

Requirements

or just

Install Kubernetes

The following sections will show you how to install k8s to OpenStack or how to use Minikube.

Use Minikube to start the Kubernetes cluster

Install Minikube if needed: https://kubernetes.io/docs/tasks/tools/install-minikube/

Start Minikube

Install kubernetes-client package (kubectl):

Install Kubernetes to OpenStack

Install k8s to OpenStack using Terraform.

You will need to have Docker installed.

Prepare the working environment inside Docker

You can skip this part if you have kubectl, Helm, Siege and Terraform installed.

Run Ubuntu docker image and mount the directory there:

Install necessary software into the Docker container:

Install kubernetes-client package - (kubectl):

Install Terraform:

Change directory to /mnt where the git repository is mounted:

Provision VMs in OpenStack

Start 3 VMs (one master and 2 workers) where the k8s will be installed.

Generate ssh keys if not exists:

Clone this git repository:

Modify the Terraform variable file if needed:

Download Terraform components:

Create VMs in OpenStack:

Show Terraform output:

Output:

At the end of the output you should see 3 IP addresses which should be accessible by ssh using your public key ~/.ssh/id_rsa.pub.

Install k8s to the VMs

Install k8s using kubeadm to the provisioned VMs:

Check if all nodes are up:

Output:

View services, deployments, and pods:

Output:

Install Helm

Install Helm binary locally:

Install Tiller (the Helm server-side component) into the Kubernetes cluster:

Check if the tiller was installed properly:

Output:

Install Rook

Rook Architecture

Install Rook Operator (Ceph storage for k8s):

See how the rook-ceph-system should look like:

Output:

Create your Rook cluster:

Get the Toolbox with Ceph commands:

Check what was created in rook-ceph namespace:

Output:

Create a storage class based on the Ceph RBD volume plugin:

Set rook-ceph-block as default Storage Class:

Check the Storage Classes:

Output:

See the CephBlockPool:

Output:

Check the status of your Ceph installation:

Output:

Ceph status:

Output:

Check the cluster usage status:

Output:

Install ElasticSearch, Kibana, FluentBit

Add ElasticSearch operator to Helm:

Install ElasticSearch operator:

Check how the operator looks like:

Output:

Install ElasticSearch cluster:

Show ElasticSearch components:

Output:

Install FluentBit:

Configure port forwarding for Kibana:

Configure ElasticSearch:

  • Navigate to the Kibana UI and click the "Set up index patterns" in the top right.

  • Use * as the index pattern, and click "Next step.".

  • Select @timestamp as the Time Filter field name, and click "Create index pattern."

Check FluentBit installation:

Output:

Istio architecture and features

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection (layer 7 firewall + loadbalancer, ingress, blocking outgoing traffic, tracing, monitoring, logging).

Policies and Telemetry: Prometheus, StatsD, FluentD and many others...

  • Istio architecture

    Istio Architecture

    • Envoy - is a high-performance proxy to mediate all inbound and outbound traffic for all services in the service mesh.

    • Pilot - provides service discovery for the Envoy sidecars, traffic management capabilities for intelligent routing.

    • Mixer - enforces access control and usage policies across the service mesh, and collects telemetry data from the Envoy proxy and other services.

    • Citadel - provides strong service-to-service and end-user authentication with built-in identity and credential management.

  • Blue-green deployment and content based traffic steering

    Traffic Management with Istio

  • Istio Security Architecture

    Istio Security Architecture

  • Mesh Expansion - non-Kubernetes services (running on VMs and/or physical machines) can be added to an Istio mesh on a Kubernetes cluster. (Istio mesh expansion on IBM Cloud Private)

    Bookinfo Application with Istio Mesh Expansion

  • Istio Multicluster - multiple k8s clusters managed by single Istio instance

Istio types

  • VirtualService defines the rules that control how requests for a service are routed within an Istio service mesh.

  • DestinationRule configures the set of policies to be applied to a request after VirtualService routing has occurred.

  • ServiceEntry is commonly used to enable requests to services outside of an Istio service mesh.

  • Gateway configures a load balancer for HTTP/TCP traffic, most commonly operating at the edge of the mesh to enable ingress traffic for an application.

Install Istio

asciicast

Either download Istio directly from https://github.com/istio/istio/releases or get the latest version by using curl:

Change the directory to the Istio installation files location:

Install istioctl:

Install Istio using Helm:

See the Istio components:

Output:

Configure Istio with a new log type and send those logs to the FluentD:

Istio example

Check how Istio can be used and how it works...

Check + Enable Istio in default namespace

Let the default namespace to use Istio injection:

Check namespaces:

Output:

Configure port forwarding for Istio services:

Deploy application into the default namespace where Istio is enabled

The Bookinfo application is broken into four separate microservices:

  • productpage - the productpage microservice calls the details and reviews microservices to populate the page.

  • details - the details microservice contains book information.

  • reviews - the reviews microservice contains book reviews. It also calls the ratings microservice.

  • ratings - the ratings microservice contains book ranking information that accompanies a book review.

There are 3 versions of the reviews microservice:

  • Version v1 - doesn’t call the ratings service.

  • Version v2 - calls the ratings service, and displays each rating as 1 to 5 black stars.

  • Version v3 - calls the ratings service, and displays each rating as 1 to 5 red stars.

Bookinfo application architecture

Application Architecture with Istio

Deploy the demo of Bookinfo application:

Confirm all services and pods are correctly defined and running:

Output:

Check the container details - you should see also container istio-proxy next to productpage:

Define the Istio gateway for the application:

Confirm the gateway has been created:

Output:

Determining the ingress IP and ports when using a node port:

Output:

Confirm the app is running:

Output:

Create default destination rules (subsets) for the Bookinfo services:

Display the destination rules:

Generate some traffic for next 5 minutes to gather some data:

Open the browser with these pages:

Bookinfo v1, v3, v2

  • Check the flows in Kiali graph

Istio Graph

Configuring Request Routing

https://istio.io/docs/tasks/traffic-management/request-routing/

Apply the virtual services which will route all traffic to v1 of each microservice:

Display the defined routes:

Output:

  • Open the Bookinfo site in your browser http://$GATEWAY_URL/productpage and notice that the reviews part of the page displays with no rating stars, no matter how many times you refresh.

Bookinfo v1

Route based on user identity

https://istio.io/docs/tasks/traffic-management/request-routing/#route-based-on-user-identity

All traffic from a user named jason will be routed to the service reviews:v2 by forwarding HTTP requests with custom end-user header to the appropriate reviews service.

Enable user-based routing:

Confirm the rule is created:

Output:

  • On the /productpage of the Bookinfo app, log in as user jason and refresh the browser.

  • Log in as another user (pick any name you wish) and refresh the browser

Bookinfo v2

You can do the same with user-agent header or URI for example:

Injecting an HTTP delay fault

https://istio.io/docs/tasks/traffic-management/fault-injection/#injecting-an-http-delay-fault

Inject a 7 seconds delay between the reviews:v2 and ratings microservices for user jason:

Confirm the rule was created:

Output:

  • On the /productpage, log in as user jason and you should see:

Bookinfo Injecting an HTTP delay fault

  • Open the Developer Tools menu (F12) -> Network tab - web page actually loads in about 6 seconds.

The following example introduces a 5 second delay in 10% of the requests to the v1 version of the ratings microservice:

Injecting an HTTP abort fault

https://istio.io/docs/tasks/traffic-management/fault-injection/#injecting-an-http-abort-fault

Let's introduce an HTTP abort to the ratings microservices for the test user jason.

Create a fault injection rule to send an HTTP abort for user jason:

Confirm the rule was created:

Output:

  • On the /productpage, log in as user jason - the page loads immediately and the product ratings not available message appears.

Bookinfo Injecting an HTTP abort fault

  • Check the flows in Kiali graph

Injecting an HTTP abort fault Kiali Graph

The following example returns an HTTP 400 error code for 10% of the requests to the ratings service v1:

Weight-based routing

https://istio.io/docs/tasks/traffic-management/traffic-shifting/#apply-weight-based-routing

In Canary Deployments, newer versions of services are incrementally rolled out to users to minimize the risk and impact of any bugs introduced by the newer version.

Route a percentage of traffic to one service or another - send %50 of traffic to reviews:v1 and %50 to reviews:v3 and finally complete the migration by sending %100 of traffic to reviews:v3.

Route all traffic to the reviews:v1 version of each microservice:

Transfer 50% of the traffic from reviews:v1 to reviews:v3:

Confirm the rule was replaced:

Output:

  • Refresh the /productpage in your browser and you now see red colored star ratings approximately 50% of the time.

  • Check the flows in Kiali graph

Weight-based routing Kiali Graph

Assuming you decide that the reviews:v3 microservice is stable, you can route 100% of the traffic to reviews:v3 by applying this virtual service.

  • When you refresh the /productpage you will always see book reviews with red colored star ratings for each review.

Bookinfo v3

Mirroring

https://istio.io/docs/tasks/traffic-management/mirroring/

Mirroring sends a copy of live traffic to a mirrored service.

First all traffic will go to reviews:v1, then the rule will be applied to mirror a portion of traffic to reviews:v2.

Apply the virtual services which will route all traffic to v1 of each microservice:

Change the route rule to mirror traffic to v2:

Check the logs on both pods reviews:v1 and reviews:v2:

  • Do a simple query by refreshing the page in the web browser.

  • Check the flows in Kiali graph

Mirroring Kiali Graph

Cleanup

  • Remove the Bookinfo application and clean it up (delete the routing rules and terminate the application pods):

List of GUIs

Links

Last updated

Was this helpful?