diff --git a/content/en/docs/examples/microservices-istio/add-istio/index.md b/content/en/docs/examples/microservices-istio/add-istio/index.md index fbc2d30799..7a0da517dd 100644 --- a/content/en/docs/examples/microservices-istio/add-istio/index.md +++ b/content/en/docs/examples/microservices-istio/add-istio/index.md @@ -94,7 +94,10 @@ disrupt your application, it continues to run and serve user requests. 1. Check the Istio dashboard, using the custom URL you set in your `/etc/hosts` file [previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file)): - [http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard](http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard). + + {{< text plain >}} + http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard + {{< /text >}} In the top left drop-down menu, select _Istio Mesh Dashboard_. diff --git a/content/en/docs/examples/microservices-istio/add-mtls/dashboard-ratings-mtls.png b/content/en/docs/examples/microservices-istio/add-mtls/dashboard-ratings-mtls.png deleted file mode 100644 index a7b1b64d81..0000000000 Binary files a/content/en/docs/examples/microservices-istio/add-mtls/dashboard-ratings-mtls.png and /dev/null differ diff --git a/content/en/docs/examples/microservices-istio/add-mtls/index.md b/content/en/docs/examples/microservices-istio/add-mtls/index.md deleted file mode 100644 index 1f29efd899..0000000000 --- a/content/en/docs/examples/microservices-istio/add-mtls/index.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: Enable mutual TLS Authentication with Istio -overview: Enable Mutual TLS Authentication on the traffic between microservices -weight: 75 - ---- - -In your current configuration, microservices communicate using HTTP, which means the traffic -is not encrypted. - -Istio helps solve this problem by encrypting the traffic between the -sidecars. This leaves only the traffic inside the application pods, and traffic -between microservices and sidecars unencrypted. - -In this module, you enable Istio -[mutual TLS authentication](/docs/reference/glossary#mutual-tls-authentication) -for the traffic between microservices in your namespace. - -1. First, check that your microservices accept unencrypted traffic. Send an - HTTP request to `ratings` from your testing pod, `sleep`: - - {{< text bash >}} - $ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath='{.items[0].metadata.name}') -- curl http://ratings:9080/ratings/7 - {"id":7,"ratings":{"Reviewer1":5,"Reviewer2":4}} - {{< /text >}} - -1. Enable mutual TLS authentication in your namespace: - - {{< text bash >}} - $ kubectl apply -f - <}}/samples/bookinfo/networking/destination-rule-all-mtls.yaml - {{< /text >}} - - {{< warning >}} - In case you did not enable the Istio Ingress Gateway, run the following command, in addition to the command above. - {{< /warning >}} - - {{< text bash >}} - $ kubectl apply -f - <}} - -1. Access your application's web page to verify that everything continues to work as expected. Recall that you - recently changed the URL of the application, e.g. `http://istio.tutorial.bookinfo.com/productpage`). - -1. Verify that your microservices do not accept unencrypted traffic anymore. - Send an HTTP request to `ratings` from your testing pod, `sleep`: - - {{< text bash >}} - $ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath='{.items[0].metadata.name}') -- curl http://ratings:9080/ratings/7 - curl: (56) Recv failure: Connection reset by peer - command terminated with exit code 56 - {{< /text >}} - - The last command failed as expected because your testing pod has no Istio - sidecar and it sent an unencrypted HTTP request to your service that requires - mutual TLS Authentication. Now communication is limited between services - where Istio sidecars are injected and only if the traffic is encrypted by the sidecar. - -1. Access the Istio dashboard at - [http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard](http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard). Check `ratings` in _Istio Service Dashboard_. Notice that now a lock icon with text `mTLS` appears in - _Service Workload_. - - {{< image width="80%" - link="dashboard-ratings-mtls.png" - caption="Istio Service Dashboard" - >}} - -1. Check your Kiali console, - [http://my-kiali.io/kiali/console](http://my-kiali.io/kiali/console), the graph of your namespace. - - In the _Display_ drop-down menu mark the _Security_ check box to see locks - that designate mutual TLS on the graph's edges. - - {{< tip >}} - You might zoom in to the graph view to see the lock icons clearly. - {{< /tip >}} - - {{< image width="80%" - link="kiali-mtls.png" - caption="Kiali Graph Tab with mutual TLS" - >}} - -Note that you made all the traffic between the pods in your cluster encrypted, -transparently to your microservice, while changing neither code nor -configuration of your microservices. diff --git a/content/en/docs/examples/microservices-istio/add-mtls/kiali-mtls.png b/content/en/docs/examples/microservices-istio/add-mtls/kiali-mtls.png deleted file mode 100644 index 16c492bdea..0000000000 Binary files a/content/en/docs/examples/microservices-istio/add-mtls/kiali-mtls.png and /dev/null differ diff --git a/content/en/docs/examples/microservices-istio/enable-istio-all-microservices/index.md b/content/en/docs/examples/microservices-istio/enable-istio-all-microservices/index.md index 42ae83f361..d1d94522ae 100644 --- a/content/en/docs/examples/microservices-istio/enable-istio-all-microservices/index.md +++ b/content/en/docs/examples/microservices-istio/enable-istio-all-microservices/index.md @@ -50,9 +50,14 @@ enable Istio on all the remaining microservices in one step. sleep-88ddbcfdd-cc85s 1/1 Running 0 7h {{< /text >}} -1. Access the Istio dashboard at - [`http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard`](http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard). - In the top left drop-down menu, select _Istio Mesh Dashboard_. Note that now all the services from your namespace +1. Access the Istio dashboard using the custom URL you set in your `/etc/hosts` file + [previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file): + + {{< text plain >}} + http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard + {{< /text >}} + +1. In the top left drop-down menu, select _Istio Mesh Dashboard_. Note that now all the services from your namespace appear in the list of services. {{< image width="80%" @@ -67,13 +72,19 @@ enable Istio on all the remaining microservices in one step. caption="Istio Service Dashboard" >}} -1. Visualize your application's topology by using the [Kiali](https://www.kiali.io) console, which is not a part of Istio. - Access - [`http://my-kiali.io/kiali/console`](http://my-kiali.io/kiali/console). - (The `my-kiali.io` URL should be in your /etc/hosts file, you set it - [previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file)). If you installed Kiali as part of the [getting started](/docs/setup/getting-started/) instructions, your Kiali console user name is `admin` and the password is `admin`. +1. Visualize your application's topology by using the + [Kiali](https://www.kiali.io) console, which is not a part of Istio, but is + installed as part of the `demo` configuration. + Access the dashboard using the custom URL you set in your `/etc/hosts` file + [previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file): - Click on the Graph tab and select your namespace in the _Namespace_ drop-down menu in the top level corner. + {{< text plain >}} + http://my-kiali.io/kiali/console + {{< /text >}} + + If you installed Kiali as part of the [getting started](/docs/setup/getting-started/) instructions, your Kiali console user name is `admin` and the password is `admin`. + +1. Click on the Graph tab and select your namespace in the _Namespace_ drop-down menu in the top level corner. In the _Display_ drop-down menu mark the _Traffic Animation_ check box to see some cool traffic animation. {{< image width="80%" @@ -81,7 +92,7 @@ enable Istio on all the remaining microservices in one step. caption="Kiali Graph Tab, display drop-down menu" >}} - Try different options in the _Edge Labels_ drop-down menu. Hover with the mouse over the nodes and edges of the +1. Try different options in the _Edge Labels_ drop-down menu. Hover with the mouse over the nodes and edges of the graph. Notice the traffic metrics on the right. {{< image width="80%" diff --git a/content/en/docs/examples/microservices-istio/logs-istio/index.md b/content/en/docs/examples/microservices-istio/logs-istio/index.md index dd8cc29ac2..8bd179febd 100644 --- a/content/en/docs/examples/microservices-istio/logs-istio/index.md +++ b/content/en/docs/examples/microservices-istio/logs-istio/index.md @@ -54,4 +54,30 @@ The queries above use the `istio_requests_total` metric, which is a standard Ist other metrics, in particular, the ones of Envoy ([Envoy](https://www.envoyproxy.io) is the sidecar proxy of Istio). You can see the collected metrics in the _insert metric at cursor_ drop-down menu. -You are ready to [enable mutual TLS authentication with Istio](/docs/examples/microservices-istio/add-mtls). +## Next steps + +Congratulations on completing the tutorial! + +These tasks are a great place for beginners to further evaluate Istio's +features using this `demo` installation: + +- [Request routing](/docs/tasks/traffic-management/request-routing/) +- [Fault injection](/docs/tasks/traffic-management/fault-injection/) +- [Traffic shifting](/docs/tasks/traffic-management/traffic-shifting/) +- [Querying metrics](/docs/tasks/observability/metrics/querying-metrics/) +- [Visualizing metrics](/docs/tasks/observability/metrics/using-istio-dashboard/) +- [Rate limiting](/docs/tasks/policy-enforcement/rate-limiting/) +- [Accessing external services](/docs/tasks/traffic-management/egress/egress-control/) +- [Visualizing your mesh](/docs/tasks/observability/kiali/) + +Before you customize Istio for production use, see these resources: + +- [Deployment models](/docs/ops/deployment/deployment-models/) +- [Deployment best practices](/docs/ops/best-practices/deployment/) +- [Pod requirements](/docs/ops/deployment/requirements/) +- [General installation instructions](/docs/setup/) + +## Join the Istio community + +We welcome you to ask questions and give us feedback by joining the +[Istio community](/about/community/join/).