Download as PDF, PPTX
Uploaded byRam Vennam
Istio Upgrade Field Guide IstioCon2022.pdf
This document serves as a field guide for safely upgrading Istio, detailing installation steps, best practices, and pre-upgrade checks to ensure a smooth transition. It emphasizes the importance of backing up configurations, analyzing states, and handling custom resources effectively. Additionally, it addresses troubleshooting post-upgrade problems and managing multi-cluster environments.
Istio Upgrade Field Guide IstioCon2022.pdf
- 1. #IstioCon A Field Guidefor Safe Istio Upgrades Ram Vennam / @RamVennam / Field Engineer @ Solo.io
- 2.
- 3.
- 4. #IstioCon What gets installed? istioctlmanifest generate --set profile=default (istioctl manifest generate -f ~/istio-1.13.2/manifests/profiles/default.yaml) CustomResourceDefinition 15 Deployment 2 Service 2 ValidatingWebhookConfiguration 1 MutatingWebhookConfiguration 1 ConfigMap 2 ServiceAccount 4 ClusterRole/ClusterRoleBinding 5 Role/RoleBinding 3 EnvoyFilter 6 HorizontalPodAutoscaler 2 PodDisruptionBudget 2
- 5. #IstioCon How are theywired together?
- 6.
- 7. #IstioCon Best Practice: SeparateIstioOperator
- 8. #IstioCon Before you upgrade: Capturestate Analyze and address any issues istioctl analyze --all-namespaces istioctl proxy-status Precheck istioctl x precheck Backup Istio CR’s kubectl get istio-io --all-namespaces -oyaml
- 9. #IstioCon Before you upgrade: Capturestate Capture everything: istioctl bug-report analyze Istio CR’s Sidecar proxy logs Gateway logs ConfigMaps
- 10.
- 11. #IstioCon Before you upgrade: UpgradeNotes (Different from release announcements and change notes)
- 12. #IstioCon Special attention ● EnvoyFilters ●EnvoyFilters ● EnvoyFilters! ● IstioOperator customizations ○ overlays ○ meshConfig ○ Compare: ~/istio-1.11.5/bin/istioctl manifest generate -f myIstioInstall.yaml ~/istio-1.12.6/bin/istioctl manifest generate -f myIstioInstall.yaml ● Resource annotations kubectl get deploy -o yaml | grep 'istio.io'
- 13. #IstioCon istioctl upgrade istioctl upgrade-f istiodIstioOperator.yaml istioctl upgrade -f ingressGatewayIstioOperator.yaml istioctl upgrade -f ewGatewayIstioOperator.yaml kubectl rollout restart deployment -n myns istioctl proxy-status
- 14. #IstioCon Problems after upgrade Analyze istioctlanalyze --all-namespaces Check the logs Compare proxy config with previous istioctl proxy-config <clusters|listeners|routes|...> istioctl bug-report Troubleshoot https://istio.io/latest/docs/ops/common-problems/ https://istio.io/latest/docs/ops/diagnostic-tools/ https://www.solo.io/blog/navigating-istio-config-toolkit/
- 15.
- 16.
- 17. Revisions: Step 1 istioctlinstall -f istiodIstioOperator.yaml --revision 1-12-1 istioctl x revision list
- 18. Revisions: Step 2 kubectllabel namespace app2 istio.io/rev=1-12-1 --overwrite kubectl rollout restart deployment -n app2 istioctl proxy-status
- 19. Revisions: Step 3 istioctlinstall -y -f ingress-gateway-test.yaml --revision 1-12-1
- 20.
- 21. #IstioCon Revision tags https://istio.io/latest/blog/2021/revision-tags/ istioctl xrevision tag list TAG REVISION NAMESPACES prod-stable 1-9-5 istioinaction prod-canary 1-10-0 istioinaction-canary
- 22.
- 23. #IstioCon One cluster ata time
- 24.
- 25.
- 26.
- 27. #IstioCon Cross cluster routing(multiple networks) cluster1: cluster2: $ istioctl pc endpoints istio-ingressgateway-78b995cf66-24td6.istio-gateways --cluster "outbound|7000||web-ui.mesh.internal" ENDPOINT STATUS OUTLIER CHECK CLUSTER 10.16.1.53:7000 HEALTHY OK outbound|7000||web-api.mesh.internal (LOCAL) 34.82.32.121:15443 HEALTHY OK outbound|7000||web-api.mesh.internal (REMOTE)
- 28. #IstioCon Front-end Failover $ istioctlpc endpoints istio-ingressgateway-78b995cf66-24td6.istio-gateways --cluster "outbound|7000||web-ui.mesh.internal" ENDPOINT STATUS OUTLIER CHECK CLUSTER 10.16.1.53:7000 HEALTHY OK outbound|7000||web-api.mesh.internal (LOCAL) 34.82.32.121:15443 HEALTHY OK outbound|7000||web-api.mesh.internal (REMOTE)
- 29.
- 30. 30 | Copyright© 2022 Idit Levine Leader in Istio Community Christian Posta Leader in Istio Community, former Chief Architect at Red Hat Lin Sun Istio Technical Oversight Committee & Steering Committee Neeraj Poddar Istio Technical Oversight Committee and Steering Committee Yuval Kohavi Chief Architect, Gloo Mesh Ram Vennam Former Istio Steering Committee Nick Nellis Contributor and maintainer of the Istio project Solo Istio/Envoy Community Leadership Founded in 2017 by Idit Levine Based in Cambridge, MA with multiple locations around the globe Industry leaders in application networking, service mesh, and modern API gateway technologies Open-Core, “Enterprise” Subscription model Growing fast with happy customers Well Funded 400+% bookings growth y/y 98%+ renewal rate $171.5M venture financing $1 Billion valuation We’re hiring! Gloo Application Networking Platform Simplify your application networking with unified control, reliability, observability, extensibility, and security 30 | Copyright © 2022
- 31.