Expose Istio

In this section you will expose Istio and the services running behind it using the NGINX Ingress Controller.

Fast Forward

If you have alreayd exposed Istio for serving, expand this box to fast-forward.

  1. Proceed to the Verify section.

What You’ll Need

Procedure

  1. Go to your GitOps repository, inside your rok-tools management environment:

    root@rok-tools:/# cd ~/ops/deployments

  2. Specify the NGINX class to use. Choose one of the following options, based on which NGINX you are using:

    Serving NGINX

    EKF NGINX

    The Serving NGINX is used by default. Continue with next step.

    Edit rok/expose-serving/overlays/deploy/kustomization.yaml and enable the ingress-class patch:

    patches: ... - path: patches/ingress-class.yaml

  3. Edit rok/expose-serving/overlays/deploy/kustomization.yaml and enable the xff patch:

    patches: ... - path: patches/xff.yaml target: kind: EnvoyFilter name: xff-trust-hops

  4. Set the number of trusted proxies in front of the Gateway:

    root@rok-tools:~/ops/deployments# export SERVING_TRUSTED_FRONT_PROXIES=1

    Note

    With MetalLB we have only one L7 proxy in front of Istio: NGINX.

  5. Render the Istio envoy filter patch template with the variables you have specified:

    root@rok-tools:~/ops/deployments# j2 \ > rok/expose-serving/overlays/deploy/patches/xff.yaml.j2 \ > -o rok/expose-serving/overlays/deploy/patches/xff.yaml

  6. Edit rok/expose-serving/overlays/deploy/kustomization.yaml and enable the ingress-host and ingress-tls patches by uncommenting the corresponding snippet:

    patches: - path: patches/ingress-host.yaml target: kind: Ingress name: istio-ingress - path: patches/ingress-tls.yaml

  7. Render the patch for Ingress rules:

    root@rok-tools:~/ops/deployments# j2 \ > rok/expose-serving/overlays/deploy/patches/ingress-host.yaml.j2 \ > -o rok/expose-serving/overlays/deploy/patches/ingress-host.yaml

  8. Render the patch for TLS termination:

    root@rok-tools:~/ops/deployments# j2 \ > rok/expose-serving/overlays/deploy/patches/ingress-tls.yaml.j2 \ > -o rok/expose-serving/overlays/deploy/patches/ingress-tls.yaml

  9. Edit rok/expose-serving/overlays/deploy/kustomization.yaml and enable the certificate-related snippets. Choose one of the following options, based on who manages your SSL certificates.

    cert-manager (self-signed)

    Managed by you

    Enable the corresponding resource and patch:

    resources: ... - ../../base/certificate.yaml patches: ... - path: patches/certificate.yaml

    Enable the secret generator for the TLS secret:

    secretGenerator: - name: knative-serving-ingress-tls-secret files: - secrets/tls.crt - secrets/tls.key type: "kubernetes.io/tls"

  10. Configure your certificate. Choose one of the following options, based on who manages your SSL certificates.

    cert-manager (self-signed)

    Managed by you

    Edit rok/expose-serving/overlays/deploy/patches/certificate.yaml, set both commonName and dnsNames to your subdomain and specify the ClusterIssuer name in issuerRef:

    spec: commonName: serving.example.com dnsNames: - serving.example.com issuerRef: name: arrikto-self-signing-issuer

    Put your SSL certificate under rok/expose-serving/overlays/deploy/secrets/tls.crt and your private key under rok/expose-serving/overlays/deploy/secrets/tls.key.

  11. Commit your changes:

    root@rok-tools:~/ops/deployments# git commit -am "Expose Istio via an NGINX Ingress"

  12. Apply the kustomization:

    root@rok-tools:~/ops/deployments# rok-deploy --apply rok/expose-serving/overlays/deploy

Verify

  1. Verify that you have successfully created the Ingress object for Istio. Wait until the ADDRESS field shows the IP address of your load balancer:

    root@rok-tools:~# kubectl get ingress -n knative-serving NAME CLASS HOSTS ADDRESS PORTS AGE knative-serving-ingress nginx-serving *.serving.example.com,serving.example.com 10.0.0.2 80, 443 1m

Summary

You have successfully configured Istio and exposed served models to the outside world.

What’s Next

Optionally, you can integrate Rok and Arrikto EKF with external platforms or projects.

PreviousNext