Expose Istio¶
In this section you will expose Istio and the services running behind it using the NGINX Ingress Controller.
Fast Forward
If you have already exposed Istio for serving, expand this box to fast-forward.
- Proceed to the Verify section.
Overview
What You’ll Need¶
- A configured management environment.
- Your clone of the Arrikto GitOps repository.
- An existing EKS cluster.
- A working NGINX Ingress Controller deployment.
- A working cert-manager deployment.
Procedure¶
Go to your GitOps repository, inside your
rok-tools
management environment:root@rok-tools:/# cd ~/ops/deploymentsSpecify the subdomain to use for serving:
root@rok-tools:~/ops/deployments# export SERVING_SUBDOMAIN=<SUBDOMAIN>Replace
<SUBDOMAIN>
with your subdomain. For example:root@rok-tools:~/ops/deployments# export SERVING_SUBDOMAIN=arrikto-cluster-serving.serving.example.comObtain the FQDN of your Load Balancer. Copy the output to your clipboard, as you are going to use this value in later steps. Choose one of the following options based on which NGINX you are using:
root@rok-tools:~/ops/deployments# kubectl get services -n ingress-nginx-serving ingress-nginx \ > -o jsonpath='{.status.loadBalancer.ingress[].hostname}{"\n"}' a4d794bfa6d7e440facc4398bf96edde-992601283.us-east-1.elb.amazonaws.comroot@rok-tools:~/ops/deployments# kubectl get services -n ingress-nginx ingress-nginx \ > -o jsonpath='{.status.loadBalancer.ingress[].hostname}{"\n"}' a4d794bfa6d7e440facc4398bf96edde-992601283.us-east-1.elb.amazonaws.comSpecify the NGINX class to use. Choose one of the following options based on which NGINX you are using:
The Serving NGINX is used by default. Continue with next step.
Edit
rok/expose-serving/overlays/deploy/kustomization.yaml
and enable theingress-class
patch:patches: ... - path: patches/ingress-class.yamlEdit
rok/expose-serving/overlays/deploy/kustomization.yaml
and enable thexff
patch:patches: ... - path: patches/xff.yaml target: kind: EnvoyFilter name: xff-trust-hopsEdit
rok/expose-serving/overlays/deploy/patches/xff.yaml
and setvalue
forxff_num_trusted_hops
to1
:value: 1Note
ELB is a TCP proxy and as such we have one L7 proxy in front of Istio: NGINX.
Edit
rok/expose-serving/overlays/deploy/kustomization.yaml
and enable theingress-host
andingress-tls
patches by uncommenting the corresponding snippet. The final result will look like this:patches: - path: patches/ingress-host.yaml target: kind: Ingress name: istio-ingress - path: patches/ingress-tls.yamlEdit
rok/expose-serving/overlays/deploy/patches/ingress-host.yaml
and setvalue
to your subdomain:- op: replace path: /spec/rules/0/host value: "*.arrikto-cluster-serving.serving.example.com" # <-- Update this line with your SERVING_SUBDOMAINNote
Use your wildcard subdomain.
Edit
rok/expose-serving/overlays/deploy/patches/ingress-tls.yaml
and sethosts
to your subdomain:spec: tls: - hosts: - "*.arrikto-cluster-serving.serving.example.com" # <-- Update this line with your SERVING_SUBDOMAINNote
Use your wildcard subdomain.
Edit
rok/expose-serving/overlays/deploy/kustomization.yaml
and enable the corresponding snippets. Choose one of the following options based on who manages your SSL certificates.Enable the secret generator for the TLS secret:
secretGenerator: - name: knative-serving-ingress-tls-secret files: - secrets/tls.crt - secrets/tls.key type: "kubernetes.io/tls"Enable the
certificate
resource and the corresponding patch:resources: ... - ../../base/certificate.yaml patches: ... - path: patches/certificate.yamlConfigure your certificate. Choose one of the following options based on who manages your SSL certificates.
- Put your SSL certificate under
rok/expose-serving/overlays/deploy/secrets/tls.crt
- Put your private key under
rok/expose-serving/overlays/deploy/secrets/tls.key
.
Edit
rok/expose-serving/overlays/deploy/patches/certificate.yaml
, and:- set
commonName
to your subdomain. - set
dnsNames
to contain both your subdomain and your wildcard subdomain.
spec: commonName: arrikto-cluster-serving.serving.example.com # <-- Update this line your SERVING_SUBDOMAIN dnsNames: - arrikto-cluster-serving.serving.example.com # <-- Update this line with your SERVING_SUBDOMAIN - "*.arrikto-cluster-serving.serving.example.com" # <-- Update this line with your wildcard SERVING_SUBDOMAIN- Put your SSL certificate under
Commit your changes:
root@rok-tools:~/ops/deployments# git commit -am "Expose Istio via an NGINX Ingress"Apply the kustomization:
root@rok-tools:~/ops/deployments# rok-deploy --apply rok/expose-serving/overlays/deployEdit
kubeflow/manifests/common/knative/knative-serving/overlays/deploy/patches/config-domain.yaml
to configure Knative to use your domain for External URLs. Replacearrikto-cluster-serving.serving.example.com
with your FQDN:data: arrikto-cluster-serving.serving.example.com: "" # <-- Update this line with your SERVING_SUBDOMAINCommit your changes:
root@rok-tools:~/ops/deployments# git commit -am "Configure Knative domain"Apply the kustomization:
root@rok-tools:~/ops/deployments# rok-deploy --apply \ > kubeflow/manifests/common/knative/knative-serving/overlays/deploy
Important
You have to create the wildcard DNS record manually, e.g., a CNAME pointing to the ELB name, or connect to your ELB directly using its FQDN and pass the correct Host header.
Verify¶
Verify that you have successfully created the Ingress object for Istio. The HOSTS field should match your wildcard subdomain:
root@rok-tools:~/ops/deployments# kubectl get ingress -n knative-serving NAME HOSTS ADDRESS PORTS AGE knative-serving-ingress *.arrikto-cluster-serving.serving.example.com a4d794bfa6d7e440facc4398bf96edde-992601283.us-east-1.elb.amazonaws.com 80, 443 1mInspect the TLS secret and verify that the SSL certificate has the expected CN and SAN:
root@rok-tools:~/ops/deployments# kubectl get secrets -n knative-serving knative-serving-ingress-tls-secret \ > -o jsonpath="{.data.tls\.crt}" | base64 -d | openssl x509 -text ... Subject: CN = arrikto-cluster-serving.serving.example.com ... X509v3 extensions: ... X509v3 Subject Alternative Name: DNS:arrikto-cluster-serving.serving.example.com, DNS:*.arrikto-cluster-serving.serving.example.com
What’s Next¶
Optionally, you can integrate Rok and Arrikto EKF with external platforms or projects.