GitHub - TimChiang0106/GCP-GKE-istio

Contribute to TimChiang0106/GCP-GKE-istio development by creating an account on GitHub.

GitHubTimChiang0106

Prerequisite

To get the IP of Cloud Shell

curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

gcloud container fleet mesh describe --project tw-rd-sp-tommy

Resister clusters to fleet

gcloud container clusters list --uri
gcloud container fleet memberships register demo-2 \\
  --gke-uri=https://container.googleapis.com/v1/projects/tw-rd-sp-tommy/zones/asia-east1-a/clusters/demo-istio-2\\
  --enable-workload-identity \\
  --project tw-rd-sp-tim
./asmcli install \\
  --project_id tw-rd-sp-tommy \\
  --cluster_name demo-istio-2 \\
  --cluster_location asia-east1-a \\
  --fleet_id tw-rd-sp-tim \\
  --enable_all \\
  --ca mesh_ca

// gcloud projects add-iam-policy-binding "ID"  \\
  --member "<serviceAccount:[email protected]>" \\
  --role roles/anthosservicemesh.serviceAgent
// gcloud container clusters update  --project id cluster \\
  --zone zone --update-labels mesh_id=proj-id

For public cluster
./asmcli create-mesh \\
      tw-rd-sp-tim \\
      tw-rd-sp-tim/asia-east1-a/cluster-istio \\
      tw-rd-sp-tommy/asia-east1-a/cluster-istio-tim

For private cluster

gcloud container clusters describe "${CLUSTER_1}" --project "${PROJECT_1}" \\
 --zone "${LOCATION_1}" --format "value(privateClusterConfig.privateEndpoint)"

Deploy applications

kubectl label namespace asm-1152-6 istio-injection=enabled istio.io/rev- --overwrite

Installation

1. default: enables components according to the default settings of the IstioOperator API. This profile is recommended for production deployments and for primary clusters in a multicluster mesh. You can display the default settings by running the istioctl profile dump command.

# Apply a default Istio installation
istioctl install

gcloud container fleet memberships register cluster-istio \\
  --gke-uri=https://container.googleapis.com/v1/projects/tw-rd-sp-tim/zones/asia-east1-a/clusters/cluster-3 \\
  --enable-workload-identity \\
  --project tw-rd-sp-tim

 ./asmcli validate \\
  --project_id tw-rd-sp-tim \\
  --cluster_name cluster-istio \\
  --cluster_location asia-east1-a \\
  --fleet_id tw-rd-sp-tim 

kubectl create namespace asm-1152-6
kubectl create serviceaccount istio-ingressgateway \\
    --namespace istio-system
kubectl get deploy -n istio-system -l app=istiod -o \\
  "jsonpath={.items[*].metadata.labels['istio\\.io/rev']}{'\\n'}"
kubectl label namespace asm-1152-6 \\
  istio.io/rev=asm-1152-6 --overwrite
kubectl apply -n asm-1152-6 \\
  -f samples/gateways/istio-ingressgateway

kubectl exec --context="${CTX_1}" -n sample -c sleep \\
    "$(kubectl get pod --context="${CTX_1}" -n sample -l \\
    app=sleep -o jsonpath='{.items[0].metadata.name}')" \\
    -- /bin/sh -c 'for i in $(seq 1 1); do nslookup helloworld.sample; done'

External-Load-balancer

cat <<EOF | istioctl install -y -f -
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      proxyMetadata:
        # Enable basic DNS proxying
        ISTIO_META_DNS_CAPTURE: "true"
        # Enable automatic address allocation, optional
        ISTIO_META_DNS_AUTO_ALLOCATE: "true"
EOF

Internal-Load-balancer

kubectl apply -f samples/httpbin/httpbin.yaml

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "httpbin.example.com"
EOF

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "httpbin.example.com"
  gateways:
  - httpbin-gateway
  http:
  - match:
    - uri:
        prefix: /status
    - uri:
        prefix: /delay
    route:
    - destination:
        port:
          number: 8000
        host: httpbin
	
EOF

istio-ilb-dev.yaml

istio-ilb-svc.yaml

Test:

curl -s -I -HHost:httpbin.example.com "http://$INGRESS_HOST:$INGRESS_PORT/status/200"

<https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/>

Error

Stuck in

asmcli: Installing ASM control plane...
Failed 

Solution:
Check your VPC route. is there any 0.0.0.0/0 default internet?

Error:
Istiod encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition
	 

Solution:

Does not have minimum availability, there is not sufficient RAM or CPU to do the install

i

Error:

pods "istio-ingressgateway-5b648874cc-" is forbidden: error looking up service account asm-1152-6/user-ingressgateway-service-account: serviceaccount "user-ingressgateway-service-account" not found

kubectl create namespace GATEWAY_NAMESPACE
kubectl create serviceaccount istio-ingressgateway-service-account \\
    --namespace istio-system

Error:

Internal error occurred: failed calling webhook "rev.namespace.sidecar-injector.istio.io": failed to call webhook: Post "<https://istiod-asm-1152-6.istio-system.svc:443/inject?timeout=10s>": context deadline exceeded

Firewall role.
15000-15100