{"id":13625513,"url":"https://github.com/redopsbay/Istio-Multi-Cluster","last_synced_at":"2025-04-16T06:32:51.697Z","repository":{"id":166014693,"uuid":"492361379","full_name":"redopsbay/Istio-Multi-Cluster","owner":"redopsbay","description":"Istio Multi Cluster Service Mesh","archived":false,"fork":false,"pushed_at":"2022-05-19T07:51:14.000Z","size":11,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-01T22:05:24.951Z","etag":null,"topics":["aws","helm","istio","kubernetes","terraform"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/redopsbay.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2022-05-15T01:32:28.000Z","updated_at":"2023-04-26T20:02:44.000Z","dependencies_parsed_at":"2024-01-14T08:42:02.392Z","dependency_job_id":"1db2d4a7-bc09-4c17-a3d8-12fc84c26a8a","html_url":"https://github.com/redopsbay/Istio-Multi-Cluster","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redopsbay%2FIstio-Multi-Cluster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redopsbay%2FIstio-Multi-Cluster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redopsbay%2FIstio-Multi-Cluster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redopsbay%2FIstio-Multi-Cluster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/redopsbay","download_url":"https://codeload.github.com/redopsbay/Istio-Multi-Cluster/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223700547,"owners_count":17188342,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","helm","istio","kubernetes","terraform"],"created_at":"2024-08-01T21:01:57.013Z","updated_at":"2024-11-08T14:31:40.973Z","avatar_url":"https://github.com/redopsbay.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# Istio Multi Cluster 🧱 #\n\n![Kubernetes](https://img.shields.io/badge/kubernetes-%23326ce5.svg?style=for-the-badge\u0026logo=kubernetes\u0026logoColor=white)\n![AWS](https://img.shields.io/badge/AWS-%23FF9900.svg?style=for-the-badge\u0026logo=amazon-aws\u0026logoColor=white)\n![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge\u0026logo=terraform\u0026logoColor=white)\n\n\n\n| Platform               | Version |\n| ---------------------- | ------- |\n| Istio                  | 1.13.2  |\n| Terraform              | v1.1.9  |\n| Terraform AWS Provider | 4.0.0   |\n| Kubernetes Version     | 1.21    |\n| Helm                   | 3       |\n\n🛡️ Introduction\n================\nSetup Istio service mesh with Multi-Primary on Different networks\n\n\n## Provisioning your infrastructure ##\n\nCreating a terraform workspace\n```\nterraform workspace new istio-service-mesh\n```\n\nPlanning Phase\n```\nterraform init\nterraform workspace select istio-service-mesh\nterraform fmt\nterraform validate\nterraform plan -out='plan.out'\n```\n\nProvisioning\n```\nterraform apply 'plan.out'\n```\n\n✅ Installing Istio inside your cluster\n======================================\n\nInstalling your Istio on your provisioned clusters via Helm Charts\n\nCluster1\n==========\nAdding Istio helm repositories\n```\nhelm repo add istio https://istio-release.storage.googleapis.com/charts\nhelm repo update\n```\n\nAdding metrics-server helm repository\n```\nhelm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/\nhelm repo update\n```\n\n🔒Making sure HPA would work. Install metrics-server on both clusters.\n```\nhelm upgrade --install metrics-server metrics-server/metrics-server -n kube-system\n```\n\nInstalling IstioBase chart\n```\nhelm upgrade --install istio-base istio/base \\\n    --create-namespace -n istio-system \\\n    --version 1.13.2 --wait\n```\n\nInstalling Istio-CP\n```\nhelm upgrade --install istiod istio/istiod -n istio-system --create-namespace \\\n    --wait --version 1.13.2 \\\n    --set global.meshID=\"cluster1\" \\\n    --set global.multiCluster.clusterName=\"cluster1\" \\\n    --set global.network=\"cluster1\" \n```\n\nInstall Istio-ingress gateway\n\n***📓 In my case. I want to use ALB instead of Classic or NLB***\n```\nkubectl create namespace istio-ingress\nkubectl label namespace istio-ingress istio-injection=enabled\n\nhelm upgrade --install istio-ingressgateway istio/gateway \\\n     -n istio-ingress --create-namespace \\\n     --version 1.13.2 --set service.type=\"NodePort\"\n``` \n\n\nCluster2\n=========\nAdding Istio helm repositories\n```\nhelm repo add istio https://istio-release.storage.googleapis.com/charts\nhelm repo update\n```\n\nAdding metrics-server helm repository\n```\nhelm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/\nhelm repo update\n```\n\n🔒Making sure HPA would work. Install `metrics-server` on both clusters.\n```\nhelm upgrade --install metrics-server metrics-server/metrics-server -n kube-system\n```\n\nInstalling IstioBase chart\n```\nhelm upgrade --install istio-base istio/base \\\n    --create-namespace -n istio-system \\\n    --version 1.13.2 --wait\n```\n\nInstalling Istio-CP\n```\nhelm upgrade --install istiod istio/istiod \\\n    -n istio-system --create-namespace \\\n    --wait --version 1.13.2 \\\n    --set global.meshID=\"cluster2\" \\\n    --set global.multiCluster.clusterName=\"cluster2\" \\\n    --set global.network=\"cluster2\"\n```\n\nSetup Ingress Controller\n==========================\n\nUse this template to create AWS ALB on your cluster and associate it with your `istio-ingressgateway` resource. `Ingress.yaml`\n```\napiVersion: networking.k8s.io/v1beta1\nkind: Ingress\nmetadata:\n  name: istio-alb-ingress\n  namespace: istio-ingress\n  annotations:\n    kubernetes.io/ingress.class: alb\n    alb.ingress.kubernetes.io/healthcheck-path: /healthz/ready\n    alb.ingress.kubernetes.io/healthcheck-port: traffic-port\n    alb.ingress.kubernetes.io/certificate-arn: \"\u003cyour-certificate-arn\u003e\"\n    alb.ingress.kubernetes.io/listen-ports: '[{ \"HTTP\": 80 }, { \"HTTPS\": 443 }]'\n    alb.ingress.kubernetes.io/security-groups: \u003cyour-security-group-id\u003e\n    alb.ingress.kubernetes.io/scheme: internet-facing\n    #alb.ingress.kubernetes.io/target-type: instance\n    alb.ingress.kubernetes.io/actions.ssl-redirect: '{\"Type\": \"redirect\", \"RedirectConfig\": { \"Protocol\": \"HTTPS\", \"Port\": \"443\", \"StatusCode\": \"HTTP_301\"}}'\n    alb.ingress.kubernetes.io/tags: Environment=Test,Provisioner=Kubernetes\n  labels:\n    app:  \"Istio\"\n    ingress: \"Istio\"\nspec:\n  rules:\n    - http:\n        paths:\n          - path: /*\n            backend:\n              serviceName: ssl-redirect\n              servicePort: use-annotation\n          - path: /healthz/ready\n            backend:\n              serviceName: istio-ingressgateway\n              servicePort: 15021\n          - path: /*\n            backend:\n              serviceName: istio-ingressgateway\n              servicePort: 443\n```\n\n## 🔐 Remove server details ##\n\nRemoving server details is very important specially on production environment. `Envoyfilter.yaml`\n```\napiVersion: networking.istio.io/v1alpha3\nkind: EnvoyFilter\nmetadata:\n  namespace: istio-system\n  name: replace-server-name\nspec:\n  workloadSelector:\n    labels:\n      istio: ingressgateway\n  configPatches:\n    - applyTo: NETWORK_FILTER\n      match:\n        context: GATEWAY\n        listener:\n          filterChain:\n            filter:\n              name: envoy.http_connection_manager\n      patch:\n        operation: MERGE\n        value:\n          typed_config:\n            '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager\n            server_name: 'custom server name'\n```\n\n## Exposing Services ##\n\nInstall additional `ingress-gateway` for both `cluster1` and `cluster2`. Since, earlier. ALB is used. So, the service discovery will fail due to Ingress gateway not directly exposing traffic.\n\n## cluster1 ##\n\n```\nhelm upgrade --install istio-crossnetworkgateway istio/gateway \\\n     -n istio-system --create-namespace --version 1.13.2\n```\n\n## cluster2 ##\n\n```\nhelm upgrade --install istio-crossnetworkgateway istio/gateway \\\n     -n istio-system --create-namespace --version 1.13.2\n```\n\nExposing services for both cluster. \n`expose-cross-network-gateway.yaml`\n```\napiVersion: networking.istio.io/v1alpha3\nkind: Gateway\nmetadata:\n  name: cross-network-gateway\n  namespace: istio-system\nspec:\n  selector:\n    app: istio-crossnetworkgateway\n  servers:\n    - port:\n        number: 15443\n        name: tls\n        protocol: TLS\n      tls:\n        mode: AUTO_PASSTHROUGH\n      hosts:\n        - \"*.local\"\n```\n\nApply the gateway config.\n```\nkubectl apply -f expose-cross-network-gateway.yaml\n```\n\nEnable endpoint discovery \n==========================\n\nThis section will provide endpoint discovery. So both cluster's can discover different endpoints.\n\nType the command on cluster1:\n```\nistioctl x create-remote-secret --name=cluster1 \u003e cluster2-secret.yaml\n```\n\nOn cluster2, Type the command:\n```\nistioctl x create-remote-secret --name=cluster2 \u003e cluster1-secret.yaml\n```\n\nApplying service discovery \n===========================\n\nOn cluster1. Type the command:\n```\nkubectl apply -f cluster1-secret.yaml\n```\n\nOn cluster2. Type the command:\n```\nkubectl apply -f cluster2-secret.yaml\n```\n\nVerify Trust Configuration\n============================\n\nVerify if trust configuration is properly plugged-in.\n```\ndiff \\\n   \u003c(export KUBECONFIG=$(pwd)/kubeconfig_cluster1.yaml \u0026\u0026 kubectl -n istio-system get secret cacerts -ojsonpath='{.data.root-cert\\.pem}') \\\n   \u003c(export KUBECONFIG=$(pwd)/kubeconfig_cluster2.yaml \u0026\u0026 kubectl -n istio-system get secret cacerts -ojsonpath='{.data.root-cert\\.pem}')\n```\n\nIf there's no certificate found on both clusters. You can generate a self-signed root CA certificate.\n\n## Generating root CA cert ##\n\n```\ncd istio-tool\nmkdir -p certs\npushd certs\nmake -f ../Makefile.selfsigned.mk root-ca\n```\n\n## Generate Cert for cluster1 ##\n\n```\nmake -f ../Makefile.selfsigned.mk cluster1-cacerts\n```\n\n## Generate cert for cluster2 ##\n\n```\nmake -f ../tools/certs/Makefile.selfsigned.mk cluster2-cacerts\n```\n\n## Creating CA Cert secret ##\n\nFrom cluster1, Apply the command below:\n```\nkubectl create secret generic cacerts -n istio-system \\\n      --from-file=cluster1/ca-cert.pem \\\n      --from-file=cluster1/ca-key.pem \\\n      --from-file=cluster1/root-cert.pem \\\n      --from-file=cluster1/cert-chain.pem\n```\n\nFrom cluster2, Apply the command below:\n```\nkubectl create secret generic cacerts -n istio-system \\\n      --from-file=cluster2/ca-cert.pem \\\n      --from-file=cluster2/ca-key.pem \\\n      --from-file=cluster2/root-cert.pem \\\n      --from-file=cluster2/cert-chain.pem\n```\n\nCross Cluster Verification\n===========================\n\nTo verify if the traffic is distributed on both cluster's. You can try the [MetaPod](https://github.com/redopsbay/MetaPod) sample application.\n\nFrom `cluster1`, Deploy the application by using the sample manifest.\n\n```\nkubectl apply -f manifests/cluster1-deployment.yaml\n```\n\nFrom `cluster2`, Deploy the application by using the sample manifest.\n\n```\nkubectl apply -f manifests/cluster2-deployment.yaml\n```\n\nReference 💡\n==========\n- [MetaPod](https://github.com/redopsbay/MetaPod)\n- [Istio Documentation](https://istio.io/latest/docs)\n- [Plugin CA Certs](https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/)\n- [Install Multi-Primary on different networks](https://istio.io/latest/docs/setup/install/multicluster/multi-primary_multi-network/)\n- [Troubleshooting Multicluster](https://istio.io/latest/docs/ops/diagnostic-tools/multicluster/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredopsbay%2FIstio-Multi-Cluster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fredopsbay%2FIstio-Multi-Cluster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredopsbay%2FIstio-Multi-Cluster/lists"}