The document outlines the deployment of Istio as an ingress controller for managing services exposed to the internet, detailing its features for securing and observing microservices. It includes key specifications for configuring gateways, virtual services, and destination rules within Kubernetes. Additionally, it provides useful links to the Istio GitHub repository and relevant documentation for further reference.

1. Arko Dasgupta
Software Engineer, Docker
DEPLOYING ISTIO AS AN
INGRESS CONTROLLER

2. WHAT IS AN INGRESS CONTROLLER
Ingress exposes Services to the Internet
Ingress Controller fulfills the Ingress Configuration

3. WHAT IS ISTIO
Open source platform kick started by
Google, IBM and Lyft in 2017
Allows developers and operators to
secure, connect and observe their
microservices

4. THE BASICS: PROXY
SOURCE https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236
Proxy

5. ISTIO - INGRESS CONTROLLER
SERVICE
POD POD
SERVICE
POD POD
INGRESS
GATEWAYPILOT
CONTROL PLANE
DATA PLANE
EXTERNAL IP

6. CUSTOM RESOURCE
DEFINITIONS
Gateways
Virtual Service
Destination Rule

7. ● Protocols exposed for external traffic
● Supports HTTP, HTTPS, TCP
● Supports SIMPLE TLS, mTLS and SNI
passthrough
● Specify TLS credentials via Kubernetes
Secrets
apiVersion:
networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: cluster-gateway
spec:
selector:
istio: ingressgateway # use
istio default controller
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
GATEWAY

8. ● Maps Requests to Kubernetes
Services
● Content based Routing
● Label Selector based Routing
● Specify weights for Load Balancing
● Supports Path Rewrites
● Supports Regular Expression Matching
apiVersion:
networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: demo-vs
spec:
hosts:
- "demo.example.com"
gateways:
- cluster-gateway
http:
- match:
route:
- destination:
host: demo-service
port:
number: 8080
---
VIRTUAL SERVICE

9. ● Apply additional policies after virtual
service routing
● Maps Subsets to Labels
● Specify many Load Balancing
algorithms such as Consistent
Hashing, Round Robin and Least
Request
● Specify Outlier detection configuration
for custom health checks
● Specify Traffic Policies such as Max
TCP connections
apiVersion:
networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: demo-destinationrule
spec:
host: demo-service
subsets:
- name: v1
labels:
version: v1
trafficPolicy:
loadBalancer:
consistentHash:
httpCookie:
name: session
ttl: 60s
---
DESTINATION RULE

10. LETS TRY IT OUT

11. SUMMARY - USEFUL LINKS
GITHUB repository - https://github.com/istio/istio
ISTIO Documentation - https://istio.io/docs/concepts/traffic-management/
Load Balancer Blog -
https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff
80236

12. THANK YOU