Install Primary-Remote on different networks

    Before proceeding, be sure to complete the steps under before you begin.

    In this configuration, cluster cluster1 will observe the API Servers in both clusters for endpoints. In this way, the control plane will be able to provide service discovery for workloads in both clusters.

    Service workloads across cluster boundaries communicate indirectly, via dedicated gateways for traffic. The gateway in each cluster must be reachable from the other cluster.

    Services in cluster2 will reach the control plane in cluster1 via the same east-west gateway.

    Primary and remote clusters on separate networks

    Today, the remote profile will install an istiod server in the remote cluster which will be used for CA and webhook injection for workloads in that cluster. Service discovery, however, will be directed to the control plane in the primary cluster.

    Future releases will remove the need for having an istiod in the remote cluster altogether. Stay tuned!

    If the istio-system namespace is already created, we need to set the cluster’s network there:

    Configure cluster1 as a primary

    Create the Istio configuration for cluster1:

    1. $ cat <<EOF > cluster1.yaml
    2. apiVersion: install.istio.io/v1alpha1
    3. kind: IstioOperator
    4. spec:
    5.   values:
    7.       multiCluster:
    8.         clusterName: cluster1
    9.       network: network1
    10. EOF

    Apply the configuration to cluster1:

    1. $ istioctl install --context="${CTX_CLUSTER1}" -f cluster1.yaml

    Install the east-west gateway in cluster1

    Install a gateway in cluster1 that is dedicated to east-west traffic. By default, this gateway will be public on the Internet. Production systems may require additional access restrictions (e.g. via firewall rules) to prevent external attacks. Check with your cloud vendor to see what options are available.

    1. $ @samples/multicluster/gen-eastwest-gateway.sh@ \
    2.     --mesh mesh1 --cluster cluster1 --network network1 | \
    3.     istioctl --context="${CTX_CLUSTER1}" install -y -f -

    If the control-plane was installed with a revision, add the --revision rev flag to the gen-eastwest-gateway.sh command.

    1. $ kubectl --context="${CTX_CLUSTER1}" get svc istio-eastwestgateway -n istio-system
    2. NAME                    TYPE           CLUSTER-IP    EXTERNAL-IP    PORT(S)   AGE
    3. istio-eastwestgateway   LoadBalancer   10.80.6.124   34.75.71.237   ...       51s

    Expose the control plane in cluster1

    Before we can install on cluster2, we need to first expose the control plane in cluster1 so that services in cluster2 will be able to access service discovery:

    Since the clusters are on separate networks, we also need to expose all user services (*.local) on the east-west gateway in both clusters. While this gateway is public on the Internet, services behind it can only be accessed by services with a trusted mTLS certificate and workload ID, just as if they were on the same network.

    Zip

    1. $ kubectl --context="${CTX_CLUSTER1}" apply -n istio-system -f \
    2.     @samples/multicluster/expose-services.yaml@

    Set the default network for cluster2

    If the istio-system namespace is already created, we need to set the cluster’s network there:

    1. $ kubectl --context="${CTX_CLUSTER2}" get namespace istio-system && \
    2.   kubectl --context="${CTX_CLUSTER2}" label namespace istio-system topology.istio.io/network=network2

    Enable API Server Access to cluster2

    Before we can configure the remote cluster, we first have to give the control plane in cluster1 access to the API Server in . This will do the following:

    • Enables the control plane to authenticate connection requests from workloads running in cluster2. Without API Server access, the control plane will reject the requests.

    To provide API Server access to cluster2, we generate a remote secret and apply it to cluster1:

    1. $ istioctl x create-remote-secret \
    2.     --context="${CTX_CLUSTER2}" \
    3.     --name=cluster2 | \
    4.     kubectl apply -f - --context="${CTX_CLUSTER1}"

    Configure cluster2 as a remote

    Save the address of cluster1’s east-west gateway.

    1. $ export DISCOVERY_ADDRESS=$(kubectl \
    2.     --context="${CTX_CLUSTER1}" \
    3.     -n istio-system get svc istio-eastwestgateway \
    4.     -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

    Now create a remote configuration on cluster2.

    Apply the configuration to cluster2:

    1. $ istioctl install --context="${CTX_CLUSTER2}" -f cluster2.yaml

    As we did with cluster1 above, install a gateway in cluster2 that is dedicated to east-west traffic and expose user services.

    Zip

    1. $ @samples/multicluster/gen-eastwest-gateway.sh@ \
    2.     --mesh mesh1 --cluster cluster2 --network network2 | \
    3.     istioctl --context="${CTX_CLUSTER2}" install -y -f -
    1. $ kubectl --context="${CTX_CLUSTER2}" get svc istio-eastwestgateway -n istio-system
    2. NAME                    TYPE           CLUSTER-IP    EXTERNAL-IP    PORT(S)   AGE
    3. istio-eastwestgateway   LoadBalancer   10.0.12.121   34.122.91.98   ...       51s

    Expose services in cluster2

    As we did with cluster1 above, expose services via the east-west gateway.

    Zip

    2.     @samples/multicluster/expose-services.yaml@

    Congratulations! You successfully installed an Istio mesh across primary and remote clusters on different networks!

    Next Steps

    You can now verify the installation.

    See also

    Before you begin

    Initial steps before configuring locality load balancing.

    Initial steps before installing Istio on multiple clusters.

    Install Multi-Primary

    Install an Istio mesh across multiple primary clusters.

    Install an Istio mesh across multiple primary clusters on different networks.

    Install Primary-Remote

    Install an Istio mesh across primary and remote clusters.

    This task demonstrates how to configure your mesh for locality failover.