From ac13ddb86c573cac2654df4b8d0f7e4b825d4145 Mon Sep 17 00:00:00 2001 From: Shriram Rajagopalan Date: Thu, 5 Oct 2017 19:40:52 -0400 Subject: [PATCH] cleanup ingress and use route rule as defacto config (#629) * cleanup ingress * nit * nit * faqs --- _docs/tasks/traffic-management/faq.md | 56 +++++ _docs/tasks/traffic-management/ingress.md | 275 ++++++++++------------ 2 files changed, 182 insertions(+), 149 deletions(-) diff --git a/_docs/tasks/traffic-management/faq.md b/_docs/tasks/traffic-management/faq.md index 3deaf9ae00..4dafae916b 100644 --- a/_docs/tasks/traffic-management/faq.md +++ b/_docs/tasks/traffic-management/faq.md @@ -23,3 +23,59 @@ type: markdown This is an known issue with the current Envoy sidecar implementation. After two seconds of creating the rule, services should become available. + +* _Can I use standard Ingress specification without any route rules?_ + + Simple ingress specifications, with host, TLS, and exact path based + matches will work out of the box without the need for route + rules. However, note that the path used in the ingress resource should + not have any `.` characters. + + For example, the following ingress resource matches requests for + example.com host, with /helloworld as the URL. + + ```bash + cat < Note: Istio does not support `ingress.kubernetes.io` annotations in the ingress resource +> specifications. Any annotation other than `kubernetes.io/ingress.class: istio` will be ignored. ## Before you begin @@ -38,7 +44,7 @@ to configure ingress behavior. ## Configuring ingress (HTTP) -1. Create the Ingress Resource for the httpbin service +1. Create a basic Ingress Resource for the httpbin service ```bash cat < Note: Envoy currently only allows a single TLS secret in the ingress since SNI is not yet supported. That means that the secret name field in ingress resource is not used, and the secret must be called `istio-ingress-certs` in `istio-system` namespace. - -1. Determine the secure ingress URL: - - * If your cluster is running in an environment that supports external load balancers, - use the ingress' external address: - - ```bash - kubectl get ingress secured-ingress -o wide - ``` - - ```bash - NAME HOSTS ADDRESS PORTS AGE - secured-ingress * 130.211.10.121 80, 443 1d - ``` - - ```bash - export SECURE_INGRESS_URL=130.211.10.121 - ``` - - > Note that in this case SECURE_INGRESS_URL should be the same as INGRESS_URL that you set previously. - - * If load balancers are not supported, use the ingress controller pod's hostIP: - - ```bash - kubectl get po -l istio=ingress -o jsonpath='{.items[0].status.hostIP}' - ``` - - ```bash - 169.47.243.100 - ``` - - along with the istio-ingress service's nodePort for port 443: - - ```bash - kubectl get svc istio-ingress - ``` - - ```bash - NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE - istio-ingress 10.10.10.155 80:31486/TCP,443:32254/TCP 32m - ``` - - ```bash - export SECURE_INGRESS_URL=169.47.243.100:32254 - ``` + 1. Access the secured httpbin service using _curl_: ```bash - curl -k https://$SECURE_INGRESS_URL/ip + curl -I -k https://$INGRESS_HOST/status/200 ``` - - ```json - { - "origin": "129.42.161.35" - } - ``` - - -## Setting Istio rules on an edge service - -Similar to inter-cluster requests, Istio -[routing rules]({{home}}/docs/concepts/traffic-management/rules-configuration.html) -can also be set for edge services -that are called from outside the cluster. -To illustrate we will use [istioctl]({{home}}/docs/reference/commands/istioctl.html) -to set a timeout rule on calls to the httpbin service. - -1. Invoke the httpbin `/delay` endpoint you exposed previously: - - ```bash - time curl -o /dev/null -s -w "%{http_code}\n" http://$INGRESS_URL/delay/5 - ``` - - ```bash - 200 - - real 0m5.024s - user 0m0.003s - sys 0m0.003s - ``` - - The request should return 200 (OK) in approximately 5 seconds. - -1. Use `istioctl` to set a 3s timeout on calls to the httpbin service - - ```bash - cat < Note: HTTP fault injection (abort and delay) is not currently supported by ingress proxies. ## Understanding ingresses @@ -301,14 +279,13 @@ In the preceding steps we created a service inside the Istio service mesh and sh to expose both HTTP and HTTPS endpoints of the service to external traffic. We also showed how to control the ingress traffic using an Istio route rule. - ## Cleanup 1. Remove the secret, Ingress Resource definitions and Istio rule. ```bash - istioctl delete routerule httpbin-3s-rule - kubectl delete ingress simple-ingress secured-ingress + istioctl delete routerule deny-route status-route + kubectl delete ingress simple-ingress secure-ingress kubectl delete -n istio-system secret istio-ingress-certs ```