{"id":19523894,"url":"https://github.com/eitansuez/istio-mesh-expansion-example","last_synced_at":"2025-08-11T00:12:16.333Z","repository":{"id":96637505,"uuid":"474694811","full_name":"eitansuez/istio-mesh-expansion-example","owner":"eitansuez","description":null,"archived":false,"fork":false,"pushed_at":"2022-03-27T17:10:51.000Z","size":13,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-07-09T11:03:05.370Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eitansuez.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-27T16:30:13.000Z","updated_at":"2022-12-18T04:26:34.000Z","dependencies_parsed_at":null,"dependency_job_id":"9e15eb60-924a-4a05-83b9-ea2aeef7830e","html_url":"https://github.com/eitansuez/istio-mesh-expansion-example","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/eitansuez/istio-mesh-expansion-example","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-mesh-expansion-example","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-mesh-expansion-example/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-mesh-expansion-example/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-mesh-expansion-example/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eitansuez","download_url":"https://codeload.github.com/eitansuez/istio-mesh-expansion-example/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-mesh-expansion-example/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269809705,"owners_count":24478598,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-10T02:00:08.965Z","response_time":71,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T00:45:06.516Z","updated_at":"2025-08-11T00:12:16.310Z","avatar_url":"https://github.com/eitansuez.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"2022.03.27\n\n# Add VM to Istio mesh in the context of the BookInfo App\n\nThis document is a recipe illustrating Istio mesh expansion using a single network and a single cluster.\n\nWe install Istio and deploy all BookInfo services to the mesh, with the exception of the ratings service, which will run separately on a VM.\n\nThe idea is to make this work, and thereby to demonstrate that Istio supports a mesh where some services run in-cluster and some outside it.\n\n## Create K8s Cluster\n\n```shell\n./scripts/make-gke-cluster\n```\n\nWait until cluster is ready.\n\n## Create the VM\n\n```shell\ngcloud compute instances create my-mesh-vm --tags=mesh-vm \\\n  --machine-type=n1-standard-2 \\\n  --network=default --subnet=default \\\n  --image-project=ubuntu-os-cloud \\\n  --image=ubuntu-2110-impish-v20220309\n```\n\n## Install ratings app on the VM\n\nWait for the machine to be ready.\n\n1. Copy over the ratings app\n\n    ```shell\n    gcloud compute scp --recurse bookinfo/ratings ubuntu@my-mesh-vm:ratings\n    ```\n\n1. ssh onto the VM\n\n    ```shell\n    gcloud compute ssh ubuntu@my-mesh-vm\n    ```\n\n1. Install nodejs, the ratings app and start it, test it.\n\n    ```shell\n    sudo apt-get install nodejs npm\n    ```\n\n1. Install dependencies\n\n    ```shell\n    cd ratings/\n    npm install\n    ```\n\n1. Run the app:\n\n    ```shell\n    node ratins.js 9080 \u0026\n    ```\n\n1. Test the app.\n\n    Retrieve a rating.\n\n    ```shell\n    curl http://localhost:9080/ratings/123\n    ```\n\n### Allow POD-to-VM traffic on port 9080\n\n```shell\nCLUSTER_POD_CIDR=$(gcloud container clusters describe my-istio-cluster --format=json | jq -r '.clusterIpv4Cidr')\n```\n\n```shell\ngcloud compute firewall-rules create \"cluster-pods-to-vm\" \\\n  --source-ranges=$CLUSTER_POD_CIDR \\\n  --target-tags=mesh-vm \\\n  --action=allow \\\n  --rules=tcp:9080\n```\n\n## Install Istio\n\n```shell\nistioctl install \\\n  --set values.pilot.env.PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION=true \\\n  --set values.pilot.env.PILOT_ENABLE_WORKLOAD_ENTRY_HEALTHCHECKS=true\n```\n\n## Deploy BookInfo (sans ratings)\n\n1. Turn on sidecar-injection.\n\n    ```shell\n    k label ns default istio-injection=enabled\n    ```\n\n1. Deploy the reviews service.\n\n    ```shell\n    k apply -f bookinfo/bookinfo-reviews.yaml\n    ```\n\n    Important: the reviews service uses an environment variable named `SERVICES_DOMAIN` that we use to adjust the ratings app target url to reflect the fact that it resides in a different namespace.\n\n1. Deploy the remaining services.\n\n    ```shell\n    k apply -f bookinfo/bookinfo-rest.yaml\n    ```\n\n## Install east-west gateway and expose Istiod\n\nControl plane traffic between the VM and istiod goes through this gateway (see [the Istio documentation](https://istio.io/latest/docs/ops/deployment/vm-architecture/)).\n\n1. Install the gateway\n\n    ```shell\n    ./scripts/gen-eastwest-gateway.sh --single-cluster | istioctl install -y -f -\n    ```\n\n1. Expose istiod\n\n    ```shell\n    k apply -n istio-system -f ./artifacts/expose-istiod.yaml\n    ```\n\n## Create the ratings namespace and service account\n\nThe ratings service running on the VM will map to the ratings namespace in kubernetes.\n\n```shell\nk create namespace ratings\n```\n\n```shell\nk create serviceaccount bookinfo-ratings -n ratings\n```\n\n## Create the WorkloadGroup\n\nA WorkloadGroup is a template for WorkloadEntity objects, see the [Istio reference](https://istio.io/latest/docs/reference/config/networking/workload-group/).\n\n```shell\nistioctl x workload group create \\\n  --name \"ratings\" \\\n  --namespace \"ratings\" \\\n  --labels app=\"ratings\" \\\n  --serviceAccount \"bookinfo-ratings\" \u003e workloadgroup.yaml\n```\n\nApply the workloadgroup:\n\n```shell\nk apply -f workloadgroup.yaml -n ratings\n```\n\n## Generate VM artifacts\n\n```shell\nistioctl x workload entry configure -f workloadgroup.yaml -o vm_files --autoregister\n```\n\nNote: check that `vm_files/hosts` is not blank. If it is, it means you ran the command too soon.  Re-run it.\n\n## VM configuration recipe\n\nCopy the generated artifacts to the VM.\n\n```shell\ngcloud compute scp vm_files/* ubuntu@my-mesh-vm:\n```\n\nSsh onto the VM\n\n```shell\ngcloud compute ssh ubuntu@my-mesh-vm\n```\n\nAnd, on the VM, run the following commands (taken from [here](https://istio.io/latest/docs/setup/install/virtual-machine/#configure-the-virtual-machine)).\n\n```\nsudo mkdir -p /etc/certs\nsudo cp ~/root-cert.pem /etc/certs/root-cert.pem\nsudo  mkdir -p /var/run/secrets/tokens\nsudo cp ~/istio-token /var/run/secrets/tokens/istio-token\ncurl -LO https://storage.googleapis.com/istio-release/releases/1.13.2/deb/istio-sidecar.deb\nsudo dpkg -i istio-sidecar.deb\nsudo cp ~/cluster.env /var/lib/istio/envoy/cluster.env\nsudo cp ~/mesh.yaml /etc/istio/config/mesh\nsudo sh -c 'cat $(eval echo ~$SUDO_USER)/hosts \u003e\u003e /etc/hosts'\nsudo mkdir -p /etc/istio/proxy\nsudo chown -R istio-proxy /etc/certs /var/run/secrets /var/lib/istio /etc/istio/config /etc/istio/proxy\n```\n\n## Exercise 1\n\nWatch the WorkloadEntry get created as a consequence of the VM registering with the mesh.\n\n```shell\nk get workloadentry -n ratings -w\n```\n\nOn the VM:\n\n```shell\nsudo systemctl start istio\n```\n\nNotice the workload entry show up in the listing.  This can take up to a minute.\n\n\n## Exercise 2\n\nAlthough the ratings services does not need to call back into the mesh, we can manually test communication from the VM into the mesh.\n\nFrom the VM, run:\n\n```shell\ncurl details.default.svc:9080/details/123\n```\n\n## Exercise 3\n\nTest communication from a pod to the ratings service running on the VM.\n\nCreate a ClusterIP service to front the application:\n\n```shell\nk apply -n ratings -f bookinfo/bookinfo-ratings.yaml\n```\n\nCreate a temporary client pod in the default namespace\n\n```shell\nk run curlpod --image=radial/busyboxplus:curl -it --rm\n```\n\nFrom within the container, run the curl command:\n\n```shell\ncurl ratings.ratings:9080/ratings/123\n```\n\nFinally, `exit` the container.\n\n\n## Put it all together\n\nExpose BookInfo:\n\n```shell\nk apply -f bookinfo/bookinfo-gateway.yaml\n```\n\nGrab your load balancer public IP address:\n\n```shell\nGATEWAY_IP=$(kubectl get svc -n istio-system istio-ingressgateway -ojsonpath='{.status.loadBalancer.ingress[0].ip}')\n```\n\nOpen a browser and visit the BookInfo product page (at /productpage).  Verify that you can see ratings on the page.\n\n```shell\ncurl $GATEWAY_IP/productpage\n```\n\n## References\n\n- https://istio.io/latest/docs/ops/deployment/vm-architecture/\n- https://istio.io/latest/docs/setup/install/virtual-machine/\n- https://github.com/GoogleCloudPlatform/istio-samples/tree/master/mesh-expansion-gce","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feitansuez%2Fistio-mesh-expansion-example","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feitansuez%2Fistio-mesh-expansion-example","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feitansuez%2Fistio-mesh-expansion-example/lists"}