如何在CentOS 上使用Istio进行多集群Kubernetes集成

Introduction

Multi-cluster Kubernetes integration is becoming increasingly important as organizations expand their Kubernetes deployments across multiple data centers, regions, or cloud providers. Managing multiple Kubernetes clusters presents a number of challenges, such as service discovery, load balancing, and network security. Istio is an open-source solution that provides a unified management plane for multiple Kubernetes clusters, making it easier to manage and scale multi-cluster deployments. In this article, we will explore how to use Istio on CentOS to perform multi-cluster Kubernetes integration.

Prerequisites

Before we proceed with using Istio on CentOS, there are a few prerequisites that need to be met:

You should have at least two Kubernetes clusters running on CentOS

The clusters should have a network connection between them

You should have root access to both Kubernetes clusters

You should have Istio installed on both Kubernetes clusters

Configure Istio for Multi-Cluster Deployment

In order to configure Istio for multi-cluster deployment, we need to perform the following steps:

Create a mesh network

Configure ingress and egress gateways

Configure service entries

Create a virtual service

Configure security using mutual TLS

Create a Mesh Network

The first step in configuring Istio for multi-cluster deployment is to create a mesh network that spans both Kubernetes clusters. We can do this by creating a MeshConfig file in each cluster and setting the network topology to "mesh".

Create a MeshConfig file in your first Kubernetes cluster:

apiVersion: install.istio.io/v1alpha1
kind: MeshConfig
spec:
  topology: mesh

Save the above YAML as a file named "meshconfig.yaml". Then, run the following command:

kubectl apply -f meshconfig.yaml

Repeat this process for your second Kubernetes cluster.

Configure Ingress and Egress Gateways

The next step is to configure ingress and egress gateways for each Kubernetes cluster. Ingress gateways allow external traffic to enter the cluster, while egress gateways allow internal traffic to leave the cluster. We must configure an ingress and egress gateway for each cluster.

Create an ingress and egress gateway for your first Kubernetes cluster:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: cluster1-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.example.com"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
    hosts:
    - "*.example.com"
    credentialName: mycredential
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: cluster1-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
    hosts:
    - "*"
    credentialName: mycredential

Create an ingress and egress gateway for your second Kubernetes cluster:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: cluster2-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.example.com"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
    hosts:
    - "*.example.com"
    credentialName: mycredential
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: cluster2-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
    hosts:
    - "*"
    credentialName: mycredential

Configure Service Entries

We must now configure service entries for each service that we wish to expose across the mesh network. Service entries allow us to define the IP addresses and port numbers of services running in other clusters. We can then use these service entries to route traffic between clusters.

Create a service entry for a service running in your second Kubernetes cluster:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: cluster2-service
spec:
  hosts:
    - cluster2-service.default.svc.cluster.local
  ports:
    - number: 80
      name: http
      protocol: HTTP
    - number: 443
      name: https
      protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
  endpoints:
    - address: 10.1.2.3
      ports:
        http: 80
        https: 443

Create a service entry for a service running in your first Kubernetes cluster:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: cluster1-service
spec:
  hosts:
    - cluster1-service.default.svc.cluster.local
  ports:
    - number: 80
      name: http
      protocol: HTTP
    - number: 443
      name: https
      protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
  endpoints:
    - address: 10.1.2.3
      ports:
        http: 80
        https: 443

Create a Virtual Service

The next step is to create a virtual service which will define how traffic is routed between clusters. We will create a virtual service that routes traffic to our service entries based on the HTTP host header.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: website
spec:
  hosts:
  - "*.example.com"
  gateways:
  - cluster1-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: cluster1-service.default.svc.cluster.local
        port:
          number: 80
  - match:
    - uri:
        prefix: /v2/
      headers:
        version:
          exact: "2.0"
    route:
    - destination:
        host: cluster2-service.default.svc.cluster.local
        port:
          number: 80

The above virtual service will route traffic to our service entries for the corresponding clusters based on the appropriate host header. We can customize this routing behavior based on different criteria such as HTTP URI and headers.

Configure Security using Mutual TLS

In order to secure communication between clusters, we can use mutual TLS authentication. This involves configuring Istio to use mTLS when communicating between clusters.

We can enable mTLS authentication for our mesh network by updating our MeshConfig files.

Update your first Kubernetes cluster's MeshConfig file:

apiVersion: install.istio.io/v1alpha1
kind: MeshConfig
spec:
  topology: mesh
  trustDomain: cluster1.example.com
  rootNamespace: istio-system
  identityTrustDomain: cluster1.example.com
  mtls:
    enabled: true
    mode: STRICT
    caCertificates: /etc/istio-cluster1/ca-certificates.pem
    peerCertificates: /etc/istio-cluster1/peer-certificates.pem
    privateKey: /etc/istio-cluster1/private-key.pem

Update your second Kubernetes cluster's MeshConfig file:

apiVersion: install.istio.io/v1alpha1
kind: MeshConfig
spec:
  topology: mesh
  trustDomain: cluster2.example.com
  rootNamespace: istio-system
  identityTrustDomain: cluster2.example.com
  mtls:
    enabled: true
    mode: STRICT
    caCertificates: /etc/istio-cluster2/ca-certificates.pem
    peerCertificates: /etc/istio-cluster2/peer-certificates.pem
    privateKey: /etc/istio-cluster2/private-key.pem

The above configuration sets mTLS to the STRICT mode, meaning that Istio will only allow mutual TLS authenticated communication between clusters. It also sets the location of the necessary certificates and private keys.

Conclusion

We have demonstrated how to use Istio on CentOS to perform multi-cluster Kubernetes integration, which is becoming increasingly important as organizations continue to expand their Kubernetes deployments. By creating a mesh network, configuring ingress and egress gateways, defining service entries, creating a virtual service, and configuring security using mutual TLS, we have established a unified management plane for our multi-cluster Kubernetes deployment. Istio's features greatly simplify the management of multiple Kubernetes clusters and streamlines the entire process.