DocsEdge Stack1.14Istio integration
Istio integration
Ambassador Edge Stack and Istio: Edge Proxy and Service Mesh together in one. Ambassador Edge Stack is deployed at the edge of your network and routes incoming traffic to your internal services (aka "north-south" traffic). Istio is a service mesh for microservices, and is designed to add application-level Layer (L7) observability, routing, and resilience to service-to-service traffic (aka "east-west" traffic). Both Istio and Ambassador Edge Stack are built using Envoy.
Ambassador Edge Stack and Istio can be deployed together on Kubernetes. In this configuration, incoming traffic from outside the cluster is first routed through Ambassador Edge Stack, which then routes the traffic to Istio-powered services. Ambassador Edge Stack handles authentication, edge routing, TLS termination, and other traditional edge functions.
This allows the operator to have the best of both worlds: a high performance, modern edge service (Ambassador Edge Stack) combined with a state-of-the-art service mesh (Istio). While Istio has introduced a Gateway abstraction, Ambassador Edge Stack still has a much broader feature set for edge routing than Istio. For more on this topic, see our blog post on API Gateway vs Service Mesh.
This guide will explain how to take advantage of both Ambassador Edge Stack and Istio to have complete control and observability over how requests are made in your cluster.
Prerequisites
- A Kubernetes cluster version 1.15 and above
- kubectl
Install Istio
Istio installation is outside of the scope of this document. Ambassador Edge Stack will integrate with any version of Istio from any installation method.
Install Ambassador Edge Stack
There a number of installation options for Ambassador Edge Stack. See the getting started for the full list of installation options and instructions.
Integrate Ambassador Edge Stack and Istio
WARNING - Istio Regression: There is a regression in Istio 1.9.0 to 1.9.4 that causes Ambassador Edge Stack (and other non-Istio services) to be unable to read Istio certificates.
A patch for this regression has been released in Istio 1.9.4.
Use Istio 1.9.4 or a version before 1.9.0 to use this integration.
Ambassador Edge Stack integrates with Istio in three ways:
- Uses Istio mutual TLS (mTLS) certificates for end-to-end encryption
- Integrates with Prometheus for centralized metrics collection
- Integrates with Istio distributed tracing for end-to-end observability
Integrating Ambassador Edge Stack and Istio allows you to take advantage of the edge routing capabilities of Ambassador Edge Stack while maintaining the end-to-end security and observability that makes Istio so powerful.
Mutual TLS
The process of collecting mTLS certificates is different depending on your Istio version. Select your Istio version below for instructions on how to integrate Ambassador Edge Stack with Istio.
Integrating Ambassador Edge Stack with Istio 1.5 and above
Istio 1.5 introduced istiod which moved Istio towards a single control plane process.
Below we will update the deployment of Ambassador Edge Stack to include the istio-proxy
sidecar, and configure the system to allow Istio and Ambassador Edge Stack to share mTLS certificates:
- Both the
istio-proxy
sidecar and Ambassador Edge Stack mount theistio-certs
volume at/etc/istio-certs
. - The
istio-proxy
sidecar will save the mTLS certificates into/etc/istio-certs
(per theOUTPUT_CERTS
environment variable). - Ambassador Edge Stack will read the mTLS certificates from
/etc/istio-certs
(per theAMBASSADOR_ISTIO_SECRET_DIR
environment variable) and create a secret namedistio-certs
.- At present, the secret name
istio-certs
cannot be changed. - To make use of the secret, use a
TLSContext
as shown below.
- At present, the secret name
Make sure the istio-proxy
is the same version as your Istio installation
Deploy the YAML above with kubectl apply
to install Ambassador Edge Stack with the istio-proxy
sidecar.
After applying the updated Ambassador Edge Stack deployment above to your cluster, we need to stage the Istio mTLS certificates for use.
We do this with a TLSContext
using the istio-certs
secret, which tracks the mTLS certificates provided from the istio-proxy
.
Ambassador Edge Stack is now integrated with Istio for end-to-end encryption.
Integrating Ambassador Edge Stack with Istio 1.4 and below
With Istio 1.4 and below, Istio stores it's mTLS certificates as a Kubernetes Secret
in each namespace.
We can read these certificates from the istio.default
Secret
in the Ambassador Edge Stack namespace with a TLSContext
.
Ambassador Edge Stack is now integrated with Istio for end-to-end encryption.
Integrating Prometheus metrics collection
Istio installs by default with a Prometheus deployment for collecting metrics from different resources in your cluster.
We can integrate Ambassador Edge Stack with the same Prometheus to give us a single metrics endpoint.
Istio's Prometheus deployment is configured using a ConfigMap
. To add Ambassador Edge Stack as a Metrics endpoint, we need to update this ConfigMap
and restart Prometheus.
Export the current Prometheus configuration.
If you installed Istio with
istioctl
, you can get the YAML that was installed withThis will export all of the YAML configuration used by Istio to a file named
istio.yaml
so you can update theConfigMap
there.If you did not install with
istioctl
, you can export the YAML of the currentConfigMap
in your cluster withkubectl
:You should now have a
ConfigMap
that looks something like this:
Update the
Prometheus
ConfigMap
to add Ambassador Edge Stack as a scraping endpointTo configure Prometheus to get metrics from Ambassador Edge Stack, add the following config under
scrape_configs
in thePrometheus
ConfigMap
we exported above and apply it withkubectl
.Restart and access the Prometheus UI
The Prometheus pod must be restarted to start with the new configuration.
After the pod restarts you can port-forward the Prometheus
Service
to access the Prometheus UI.You can now access the UI at http://localhost:9090/
Integrating distributed tracing
Enabling the tracing component in Istio gives you the power to observe how a request behaves at each point in your application.
Since Istio will propagate the tracing headers automatically, integrating Ambassador Edge Stack with the Istio Jaeger deployment will give you end-to-end observability of requests throughout your cluster.
To do so, simply create a TracingService
and point it at the zipkin
Service
in the istio-system namespace.
After applying this configuration with kubectl apply
, restart the Ambassador Edge Stack pod for the configuration to take effect.
You can now access the tracing service UI to see Ambassador Edge Stack is now one of the services.
Routing to services
Above, we integrated Ambassador Edge Stack with Istio to take advantage of end-to-end encryption and observability offered by Istio while leveraging the feature-rich edge routing capabilities of Ambassador Edge Stack.
Now we will show how you can use Ambassador Edge Stack to route to services in the Istio service mesh.
Label the default namespace for automatic sidecar injection
This will tell Istio to automatically inject the
istio-proxy
sidecar container into pods in this namespace.Install the quote example service
Wait for the pod to start and see that there are two containers: the
quote
application and theistio-proxy
sidecar.Route to the service
Traffic routing in Ambassador Edge Stack is configured with the
Mapping
resource. This is a powerful configuration object that lets you configure different routing rules for different services.The above
kubectl apply
installed the following basicMapping
which has configured Ambassador Edge Stack to route traffic with URL prefix/backend/
to thequote
service.Since we have integrated Ambassador Edge Stack with Istio, we can tell it to use the mTLS certificates to encrypt requests to the quote service.
Simply do that by updating the above
Mapping
with the following one.Send a request to the quote service using curl:
While the majority of the work being done is transparent to the user, you have successfully sent a request to Ambassador Edge Stack which routed it to the quote service in the default namespace. It was then intercepted by the
istio-proxy
which authenticated the request from Ambassador Edge Stack and exported various metrics and finally forwarded it on to the quote service.
Enforcing authentication between containers
Istio defaults to PERMISSIVE mTLS that does not require authentication between containers in the cluster. Configuring STRICT mTLS will require all connections within the cluster be encrypted.
Configure Istio in STRICT mTLS mode.
This will enforce authentication for all containers in the mesh.
We can test this by removing the
tls
configuration from the quote-backendMapping
and sending a request.
Configure Ambassador Edge Stack to use mTLS certificates
As we have demonstrated above we can tell Ambassador Edge Stack to use the mTLS certificates from Istio to authenticate with the
istio-proxy
in the quote pod.Now Ambassador Edge Stack will use the Istio mTLS certificates when routing to the
quote
service.
Grafana
The Istio Grafana addon integrates a Grafana dashboard with the Istio Prometheus deployment to visualize the metrics collected there.
The metrics Ambassador Edge Stack adds to the list will appear in the Istio dashboard but we can add an Ambassador Edge Stack dashboard as well. We're going to use the Ambassador Edge Stack dashboard on Grafana's website under entry 4689 as a starting point.
First, let's start the port-forwarding for Istio's Grafana service:
Now, open Grafana tool by accessing: http://localhost:3000/
To install the Ambassador Edge Stack Dashboard:
- Click on Create
- Select Import
- Enter number 4698
Now we need to adjust the Dashboard Port to reflect our Ambassador Edge Stack configuration:
- Open the Imported Dashboard
- Click on Settings in the Top Right corner
- Click on Variables
- Change the port to 80 (according to the Ambassador Edge Stack service port)
Next, adjust the Dashboard Registered Services metric:
- Open the Imported Dashboard
- Find Registered Services
- Click on the down arrow and select Edit
- Change the Metric to:
Now let's save the changes:
- Click on Save Dashboard in the Top Right corner
FAQ
How to test Istio certificate rotation
Istio mTLS certificates, by default, will be valid for a max of 90 days but will be rotated every day.
Ambassador Edge Stack will watch and update the mTLS certificates as they rotate so you will not need to worry about certificate expiration.
To test that Ambassador Edge Stack is properly rotating certificates you can shorten the TTL of the Istio certificates so you can verify that Ambassador Edge Stack is using the new certificates.
In Istio 1.5 and above, you can configure that by setting the following environment variables in the istiod
container.
In Istio 1.4 and below, you can configure this by passing the following arguments to the istio-citadel
container
This will make the certificates Istio issues expire in one hour so testing certificate rotation is much easier.