Install Primary-Remote
Before proceeding, be sure to complete the steps under .
If you are testing multicluster setup on kind
you can use MetalLB to make use of EXTERNAL-IP
for LoadBalancer
services.
In this configuration, cluster cluster1
will observe the API Servers in both clusters for endpoints. In this way, the control plane will be able to provide service discovery for workloads in both clusters.
Service workloads communicate directly (pod-to-pod) across cluster boundaries.
Services in cluster2
will reach the control plane in cluster1
via a dedicated gateway for traffic.
Primary and remote clusters on the same network
Today, the remote profile will install an istiod server in the remote cluster which will be used for CA and webhook injection for workloads in that cluster. Service discovery, however, will be directed to the control plane in the primary cluster.
Create the Istio configuration for cluster1
:
Apply the configuration to cluster1
:
$ istioctl install --context="${CTX_CLUSTER1}" -f cluster1.yaml
Install the east-west gateway in cluster1
Install a gateway in that is dedicated to traffic. By default, this gateway will be public on the Internet. Production systems may require additional access restrictions (e.g. via firewall rules) to prevent external attacks. Check with your cloud vendor to see what options are available.
$ @samples/multicluster/gen-eastwest-gateway.sh@ \
--mesh mesh1 --cluster cluster1 --network network1 | \
If the control-plane was installed with a revision, add the --revision rev
flag to the gen-eastwest-gateway.sh
command.
Wait for the east-west gateway to be assigned an external IP address:
Before we can install on cluster2
, we need to first expose the control plane in cluster1
so that services in cluster2
will be able to access service discovery:
$ kubectl apply --context="${CTX_CLUSTER1}" -n istio-system -f \
@samples/multicluster/expose-istiod.yaml@
Enable API Server Access to cluster2
Enables the control plane to authenticate connection requests from workloads running in
cluster2
. Without API Server access, the control plane will reject the requests.Enables discovery of service endpoints running in
cluster2
.
To provide API Server access to cluster2
, we generate a remote secret and apply it to cluster1
:
$ istioctl x create-remote-secret \
--name=cluster2 | \
kubectl apply -f - --context="${CTX_CLUSTER1}"
Save the address of cluster1
’s east-west gateway.
Now create a remote configuration for cluster2
.
$ cat <<EOF > cluster2.yaml
kind: IstioOperator
spec:
values:
global:
meshID: mesh1
multiCluster:
clusterName: cluster2
network: network1
remotePilotAddress: ${DISCOVERY_ADDRESS}
Apply the configuration to cluster2
:
$ istioctl install --context="${CTX_CLUSTER2}" -f cluster2.yaml
Congratulations! You successfully installed an Istio mesh across primary and remote clusters!
Next Steps
You can now verify the installation.