Skip to content

Ingress Lab

This lab aims to expose the web-frontend service to the internet.

The Ingress Gateway

When Istio was installed, it deployed istiod to Kubernetes and created an Ingress Gateway.

View the corresponding Istio Ingress Gateway pod in the istio-system namespace.

kubectl get pod -l istio=ingressgateway -n istio-system

A corresponding LoadBalancer type service was also created.

kubectl get svc -n istio-system

Make a note of the external IP address for the load balancer.

Assign it to an environment variable.

GATEWAY_IP=$(kubectl get svc -n istio-system public-ingressgateway -ojsonpath='{.status.loadBalancer.ingress[0].ip}')
A small investment.

When the cloud shell connection is severed, or when opening a new terminal tab, $GATEWAY_IP will no longer be in scope.

Ensure GATEWAY_IP is set each time we start a new shell:

cat << EOF >> ~/.bashrc

export GATEWAY_IP=$(kubectl get svc -n istio-system public-ingressgateway -ojsonpath='{.status.loadBalancer.ingress[0].ip}')

EOF

Usually, we associate this IP address with a hostname via DNS. For the sake of simplicity, in this workshop, we will use the gateway public IP address directly.

Configuring Ingress

Configuring Ingress with Istio is performed in two parts:

  1. Define a Gateway custom resource that governs the specific host, port, and protocol to expose.
  2. Specify how requests should be routed with a VirtualService custom resource.

Create a Gateway resource

  1. Review the following Gateway specification.

    gateway.yaml

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
    ---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: frontend-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"

    Above, we specify the HTTP protocol, port 80, and a wildcard (“*”) host matcher, ensuring that HTTP requests using the load balancer IP address $GATEWAY_IP will match.

    The selector istio: ingressgateway ensures that this gateway resource binds to the physical Ingress Gateway.

  2. Apply the gateway resource to your cluster.

    kubectl apply -f gateway.yaml

  3. Attempt an HTTP request in your browser to the gateway IP address. It should return a 404 (not found).

Create a VirtualService resource

  1. Review the following VirtualService specification.

    web-frontend-virtualservice.yaml 
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
    ---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: web-frontend
spec:
  hosts:
    - "*"
  gateways:
    - frontend-gateway
  http:
    - route:
        - destination:
            host: web-frontend.default.svc.cluster.local
            port:
              number: 80

    Note how this specification references the name of the gateway (“frontend-gateway”), a matching host (“*”), and specifies a route for requests to be directed to the web-frontend service.

  2. Apply the virtual service resource to your cluster.

    kubectl apply -f web-frontend-virtualservice.yaml

  3. List virtual services in the default namespace.

    kubectl get virtualservice

    The output indicates that the web-frontend virtual service is bound to the gateway and any hostname that routes to the load balancer IP address.

Finally, verify that you can access web-frontend from your web browser using the gateway IP address.

curl $GATEWAY_IP | head

Candidate follow-on exercises

We will not explore Ingress any further in this workshop. Consider the following tasks as independent exercises:

Next

The application is now running and exposed on the internet.

Our next chapter will cover the observability features of Istio.