mirror of https://github.com/istio/istio.io.git
44 lines
18 KiB
HTML
44 lines
18 KiB
HTML
<!DOCTYPE html><html lang="en" itemscope itemtype="https://schema.org/WebPage" style="overflow-y: scroll;"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="title" content="Enabling Egress Traffic"><meta name="og:title" content="Enabling Egress Traffic"><meta name="og:image" content="/v0.1/img/logo.png"/><meta name="description" content="Describes how to configure Istio to route traffic from services in the mesh to external services."><meta name="og:description" content="Describes how to configure Istio to route traffic from services in the mesh to external services."><title>Istioldie 0.1 / Enabling Egress Traffic</title><script> window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date; ga('create', 'UA-98480406-2', 'auto'); ga('send', 'pageview'); </script> <script async src='https://www.google-analytics.com/analytics.js'></script><link href='https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css'><link rel="alternate" type="application/rss+xml" title="Istio Blog RSS" href="/v0.1/feed.xml"><link rel="apple-touch-icon" href="/v0.1/favicons/apple-touch-icon.png" sizes="180x180"><link rel="icon" type="image/png" href="/v0.1/favicons/android-chrome-96x96.png" sizes="96x96" ><link rel="icon" type="image/png" href="/v0.1/favicons/favicon-32x32.png" sizes="32x32"><link rel="icon" type="image/png" href="/v0.1/favicons/favicon-16x16.png" sizes="16x16"><link rel="manifest" href="/v0.1/favicons/manifest.json"><link rel="mask-icon" href="/v0.1/favicons/safari-pinned-tab.svg" color="#2DA6B0"><meta name="msapplication-TileColor" content="#ffffff"><meta name="msapplication-TileImage" content="/v0.1/favicons/mstile-150x150.png"><link href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.1/css/bootstrap.min.css" rel="stylesheet"><link rel="stylesheet" href="/v0.1/css/all.css"><link rel="stylesheet" href="/v0.1/css/prism.css"><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css"> <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script></head><body class="language-unknown"><div class="nav-hero-container" style="z-index: 200000;"><nav id="header-nav" class="navbar navbar-inverse" role="navigation"><div class="container"><div class="row"><div class="col-md-11 nofloat center-block "><div class="navbar-header"> <button type="button" class="hamburger navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar-collapse-1" aria-expanded="false"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand" href="/v0.1/"><div> <img src="/v0.1/img/logo.png" alt="Istio" width="36px" height="54px"/> <span class="brand-name">Istioldie 0.1</span></div></a></div><div class="collapse navbar-collapse" id="navbar-collapse-1"><ul class="nav navbar-nav navbar-right"><li><a href="/v0.1/about/" >About</a></li><li><a href="/v0.1/docs/" class='current'>Docs</a></li><li><a href="/v0.1/blog/" >Blog</a></li><li><a href="/v0.1/community/" >Community</a></li><li><a href="/v0.1/faq/" >FAQ</a></li><li class="dropdown"> <a class="dropdown-toggle" data-toggle="dropdown" href=""> <i class='fa fa-lg fa-cog'></i> <span class="caret"></span> </a><ul class="dropdown-menu"><h6 class="dropdown-header">Other versions of this site</h6><li> <a href="https://istio.io">Current Release</a></li><li> <a href="https://preliminary.istio.io">Next Release</a></li><li> <a href="https://archive.istio.io">Older Releases</a></li></ul></li><li><form name="cse" id="searchbox_demo" class="navbar-form navbar-right" role="search"> <input type="hidden" name="cx" value="013699703217164175118:iwwf17ikgf4" /> <input type="hidden" name="ie" value="utf-8" /> <input type="hidden" name="hl" value="en" /><div class="form-group"><div class="input-group"> <input name="q" class="form-control" type="text" size="30" /><div class="input-group-addon"> <span class="btn-search glyphicon glyphicon-search"></span></div></div></div></form> <script type="text/javascript" src="https://www.google.com/cse/brand?form=searchbox_demo"></script></li></ul></div></div></div></div></nav></div><div class="container"><div class="row"><div class="col-md-11 nofloat center-block" style="margin-top: 3px;"><ul class="col-sm-10 nav nav-tabs"><li role="presentation" ><a href="/v0.1/docs/index.html">Welcome</a></li><li role="presentation" ><a href="/v0.1/docs/concepts/index.html">Concepts</a></li><li role="presentation" class='active'><a href="/v0.1/docs/tasks/index.html">Tasks</a></li><li role="presentation" ><a href="/v0.1/docs/samples/index.html">Samples</a></li><li role="presentation" ><a href="/v0.1/docs/reference/index.html">Reference</a></li></ul></div></div></div><script src="/v0.1/js/navtree.js"></script><div class="container docs"><div class="row"><div class="col-md-11 nofloat center-block"><div class="row"><div id="sidebar-container" class="col-sm-3"><ul class="doc-side-nav"><li><h5 class='doc-side-nav-title'>Tasks</h5></li><script type="text/javascript"> var docs = []; docs.push({path: [ "basic-access-control.md", ], url: "/docs/tasks/basic-access-control.html", title: "Enabling Simple Access Control", order: 90, overview: "This task shows how to use Istio to control access to a service."}); docs.push({path: [ "egress.md", ], url: "/docs/tasks/egress.html", title: "Enabling Egress Traffic", order: 40, overview: "Describes how to configure Istio to route traffic from services in the mesh to external services."}); docs.push({path: [ "fault-injection.md", ], url: "/docs/tasks/fault-injection.html", title: "Fault Injection", order: 60, overview: "This task shows how to inject delays and test the resiliency of your application."}); docs.push({path: [ "index.md", ], url: "/docs/tasks/index.html", title: "Tasks", order: 20, overview: "Tasks show you how to do a single specific targeted activity with the Istio system."}); docs.push({path: [ "ingress.md", ], url: "/docs/tasks/ingress.html", title: "Enabling Ingress Traffic", order: 30, overview: "Describes how to configure Istio to expose a service outside of the service mesh."}); docs.push({path: [ "installing-istio.md", ], url: "/docs/tasks/installing-istio.html", title: "Installing Istio", order: 10, overview: "This task shows you how to setup the Istio service mesh."}); docs.push({path: [ "integrating-services-into-istio.md", ], url: "/docs/tasks/integrating-services-into-istio.html", title: "Integrating Services into the Mesh", order: 20, overview: "This task shows you how to integrate your applications with the Istio service mesh."}); docs.push({path: [ "istio-auth.md", ], url: "/docs/tasks/istio-auth.html", title: "Testing Istio Auth", order: 100, overview: "This task shows you how to verify and test Istio-Auth."}); docs.push({path: [ "metrics-logs.md", ], url: "/docs/tasks/metrics-logs.html", title: "Collecting Metrics and Logs", order: 110, overview: "This task shows you how to configure Mixer to collect metrics and logs from Envoy instances."}); docs.push({path: [ "rate-limiting.md", ], url: "/docs/tasks/rate-limiting.html", title: "Enabling Rate Limits", order: 80, overview: "This task shows you how to use Istio to dynamically limit the traffic to a service."}); docs.push({path: [ "request-routing.md", ], url: "/docs/tasks/request-routing.html", title: "Configuring Request Routing", order: 50, overview: "This task shows you how to configure dynamic request routing based on weights and HTTP headers."}); docs.push({path: [ "request-timeouts.md", ], url: "/docs/tasks/request-timeouts.html", title: "Setting Request Timeouts", order: 70, overview: "This task shows you how to setup request timeouts in Envoy using Istio."}); docs.push({path: [ "zipkin-tracing.md", ], url: "/docs/tasks/zipkin-tracing.html", title: "Distributed Request Tracing", order: 120, overview: "How to configure the proxies to send tracing requests to Zipkin"}); genNavBarTree(docs) </script></ul></div><div id="tab-container" class="col-xs-1 tab-neg-margin pull-left"> <a id="sidebar-tab" class="glyphicon glyphicon-chevron-left" href="javascript:void 0;"></a></div><div id="content-container" class="thin-left-border col-sm-9 markdown"><div id="toc" class="toc"></div><div id="doc-content"><h1>Enabling Egress Traffic</h1><p>By default, Istio-enabled services are unable to access URLs outside of the cluster because iptables is used in the pod to transparently redirect all outbound traffic to the sidecar proxy, which only handles intra-cluster destinations.</p><p>This task describes how to configure Istio to expose external services to Istio-enabled clients. You’ll learn how to configure an external service and make requests to it via the Istio egress service or, alternatively, to simply enable direct calls to an external service.</p><h2 id="before-you-begin">Before you begin</h2><ul><li><p>Setup Istio by following the instructions in the <a href="./installing-istio.html">Installation guide</a>.</p></li><li><p>Start the <a href="https://github.com/istio/istio/tree/master/samples/apps/sleep">sleep</a> sample which will be used as a test source for external calls.</p><pre><code class="language-bash">kubectl apply -f <(istioctl kube-inject -f samples/apps/sleep/sleep.yaml)
|
||
</code></pre><p>Note that any pod that you can <code>exec</code> and <code>curl</code> from would do.</p></li></ul><h2 id="using-the-istio-egress-service">Using the Istio Egress service</h2><p>Using the Istio Egress service, you can access any publicly accessible service from within your Istio cluster. In this task we will use <a href="http://httpbin.org">httpbin.org</a> and <a href="http://www.google.com">www.google.com</a> as examples.</p><h3 id="configuring-the-external-services">Configuring the external services</h3><ol><li><p>Register an external HTTP service:</p><pre><code class="language-bash">cat <<EOF | kubectl create -f -
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: externalbin
|
||
spec:
|
||
type: ExternalName
|
||
externalName: httpbin.org
|
||
ports:
|
||
- port: 80
|
||
# important to set protocol name
|
||
name: http
|
||
EOF
|
||
</code></pre></li><li><p>Register an external HTTPS service:</p><pre><code class="language-bash">cat <<EOF | kubectl create -f -
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: securegoogle
|
||
spec:
|
||
type: ExternalName
|
||
externalName: www.google.com
|
||
ports:
|
||
- port: 443
|
||
# important to set protocol name
|
||
name: https
|
||
EOF
|
||
</code></pre></li></ol><p>The <code>metadata.name</code> field is the url your internal apps will use when calling the external service. The <code>spec.externalName</code> is the DNS name of the external service. Egress Envoy expects external services to be listening on either port <code>80</code> for HTTP or port <code>443</code> for HTTPS.</p><h3 id="make-requests-to-the-external-services">Make requests to the external services</h3><ol><li><p>Exec into the pod being used as the test source. For example, if you are using the sleep service, run the following commands:</p><pre><code class="language-bash">export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
|
||
kubectl exec -it $SOURCE_POD -c sleep bash
|
||
</code></pre></li><li><p>Make a request to an external service using the <code>name</code> from the Service spec above followed by the path to the desired API endpoint:</p><pre><code class="language-bash">curl http://externalbin/headers
|
||
</code></pre></li><li><p>For external services of type HTTPS, the port must be specified in the request. App clients should make the request over HTTP since the Egress Envoy will initiate HTTPS with the external service:</p><pre><code class="language-bash">curl http://securegoogle:443
|
||
</code></pre></li></ol><h2 id="calling-external-services-directly">Calling external services directly</h2><p>The Istio Egress service currently only supports HTTP/HTTPS requests. If you want to access services with other protocols (e.g., mongodb://host/database), or if you simply don’t want to use the Egress proxy, you will need to configure the source service’s Envoy sidecar to prevent it from <a href="/v0.1/docs/concepts/traffic-management/request-routing.html#communication-between-services">intercepting</a> the external requests. This can be done using the <code>--includeIPRanges</code> option of <a href="/v0.1/docs/reference/commands/istioctl.html#istioctl-kube-inject">istioctl kube-inject</a> when starting the service.</p><p>The simplest way to use the <code>--includeIPRanges</code> option is to pass it the IP range(s) used for internal cluster services, thereby excluding external IPs from being redirected to the sidecar proxy. The values used for internal IP range(s), however, depends on where your cluster is running. For example, with Minikube the range is 10.0.0.1/24, so you would start the sleep service like this:</p><pre><code class="language-bash">kubectl apply -f <(istioctl kube-inject -f samples/apps/sleep/sleep.yaml --includeIPRanges=10.0.0.1/24)
|
||
</code></pre><p>On IBM Bluemix, use:</p><pre><code class="language-bash">kubectl apply -f <(istioctl kube-inject -f samples/apps/sleep/sleep.yaml --includeIPRanges=172.30.0.0/16,172.20.0.0/16)
|
||
</code></pre><p>On Google Container Engine (GKE) the ranges are not fixed, so you will need to run the <code>gcloud container clusters describe</code> command to determine the ranges to use. For example:</p><pre><code class="language-bash">gcloud container clusters describe XXXXXXX --zone=XXXXXX | grep -e clusterIpv4Cidr -e servicesIpv4Cidr
|
||
</code></pre><pre><code>clusterIpv4Cidr: 10.4.0.0/14
|
||
servicesIpv4Cidr: 10.7.240.0/20
|
||
</code></pre><pre><code class="language-bash">kubectl apply -f <(istioctl kube-inject -f samples/apps/sleep/sleep.yaml --includeIPRanges=10.4.0.0/14,10.7.240.0/20)
|
||
</code></pre><p>On Azure Container Service(ACS), use:</p><pre><code class="language-bash">kubectl apply -f <(istioctl kube-inject -f samples/apps/sleep/sleep.yaml --includeIPRanges=10.244.0.0/16,10.240.0.0/16)
|
||
</code></pre><p>After starting your service this way, the Istio sidecar will only intercept and manage internal requests within the cluster. Any external request will simply bypass the sidecar and go straight to its intended destination.</p><pre><code class="language-bash">export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
|
||
kubectl exec -it $SOURCE_POD -c sleep curl http://httpbin.org/headers
|
||
</code></pre><h2 id="understanding-what-happened">Understanding what happened</h2><p>In this task we looked at two ways to call external services from within an Istio cluster:</p><ol><li><p>Using the Istio egress service (recommended)</p></li><li><p>Configuring the Istio sidecar to exclude external IPs from its remapped IP table</p></li></ol><p>The first approach (Egress service) currently only supports HTTP(S) requests, but allows you to use all of the same Istio service mesh features for calls to services within or outside of the cluster.</p><p>The second approach bypasses the Istio sidecar proxy, giving your services direct access to any external URL. However, configuring the proxy this way does require cloud provider specific knowledge and configuration.</p><h2 id="cleanup">Cleanup</h2><ol><li><p>Remove the external services.</p><pre><code class="language-bash">kubectl delete service externalbin securegoogle
|
||
</code></pre></li><li><p>Shutdown the <a href="https://github.com/istio/istio/tree/master/samples/apps/sleep">sleep</a> service.</p><pre><code class="language-bash">kubectl delete -f samples/apps/sleep/sleep.yaml
|
||
</code></pre></li></ol><h2 id="whats-next">What’s next</h2><ul><li><p>Read more about the <a href="/v0.1/docs/concepts/traffic-management/request-routing.html#ingress-and-egress-envoys">egress service</a>.</p></li><li><p>Learn how to use Istio’s <a href="./request-routing.html">request routing</a> features.</p></li></ul></div></div></div></div></div></div><script src="/v0.1/js/sidemenu.js"></script><footer><div class="container"><div class="row"><div class="col-md-2"></div><div class="col-md-3 col-sm-4 col-xs-12 center-block"><ul class="toggle"><p class="header">Docs</p><li><a href="/v0.1/docs/">Welcome</a></li><li><a href="/v0.1/docs/concepts">Concepts</a></li><li><a href="/v0.1/docs/tasks">Tasks</a></li><li><a href="/v0.1/docs/samples">Samples</a></li><li><a href="/v0.1/docs/reference">Reference</a></li></ul></div><hr class="footer-sections" /><div class="col-md-3 col-sm-4 col-xs-12 center-block"><ul class="toggle"><p class="header">Resources</p><li><a href="/v0.1/faq">Frequently Asked Questions</a></li><li><a href="/v0.1/troubleshooting">Troubleshooting Guide</a></li><li><a href="/v0.1/bugs">Report a Bug</a></li><li><a href="https://github.com/istio/istio.github.io/issues/new?title=Issue with _docs/tasks/egress.md">Report a Doc Issue</a></li><li><a href="https://github.com/istio/istio.github.io/edit/master/_docs/tasks/egress.md">Edit This Page on GitHub</a></li></ul></div><hr class="footer-sections" /><div class="col-md-3 col-sm-4 col-xs-12 center-block"><ul class="toggle"><p class="header">Community</p><li><a href="https://groups.google.com/forum/#!forum/istio-users" target="_blank"><span class="group">User</span></a> | <a href="https://groups.google.com/forum/#!forum/istio-dev" target="_blank">Dev Mailing Lists</a></li><li><a href="https://twitter.com/IstioMesh" target="_blank"><span class="twitter">Twitter</span></a></li><li><a href="https://github.com/istio/istio" target="_blank"><span class="github">GitHub</span></a></li></ul></div><div class="col-md-1"></div></div><div class="row"><p class="description small text-center"> Copyright © 2017 Istio Authors<br> Istio 0.1<br> Archived on 20-Jul-2017</p></div></div></footer><script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/jquery.validate.min.js"></script> <script src="/v0.1/js/jquery.form.min.js"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.1/js/bootstrap.min.js"></script> <script src="/v0.1/js/slick.min.js"></script> <script src="/v0.1/js/jquery.visible.min.js"></script> <script src="/v0.1/js/common.js" type="text/javascript" charset="utf-8"></script> <script src="/v0.1/js/buttons.js"></script> <script src="/v0.1/js/search.js"></script> <script src="/v0.1/js/prism.js"></script></body></html>
|