mirror of https://github.com/istio/istio.io.git
100 lines
47 KiB
HTML
100 lines
47 KiB
HTML
<!DOCTYPE html><html lang="en" itemscope itemtype="https://schema.org/WebPage" style="overflow-y: scroll;"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="title" content="Frequently Asked Questions"><meta name="og:title" content="Frequently Asked Questions"><meta name="og:image" content="/v0.3/img/logo.png"/><meta name="theme-color" content="#466BB0"/><meta name="description" content="Frequently Asked Questions about Istio."><meta name="og:description" content="Frequently Asked Questions about Istio."><title>Istioldie 0.3 / Frequently Asked Questions</title><script> window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date; ga('create', 'UA-98480406-2', 'auto'); ga('send', 'pageview'); </script> <script async src='https://www.google-analytics.com/analytics.js'></script><link rel="alternate" type="application/rss+xml" title="Istio Blog RSS" href="/v0.3/feed.xml"><link rel="shortcut icon" href="/v0.3/favicons/favicon.ico" ><link rel="apple-touch-icon" href="/v0.3/favicons/apple-touch-icon-180x180.png" sizes="180x180"><link rel="icon" type="image/png" href="/v0.3/favicons/favicon-16x16.png" sizes="16x16"><link rel="icon" type="image/png" href="/v0.3/favicons/favicon-32x32.png" sizes="32x32"><link rel="icon" type="image/png" href="/v0.3/favicons/android-36x36.png" sizes="36x36"><link rel="icon" type="image/png" href="/v0.3/favicons/android-48x48.png" sizes="48x48"><link rel="icon" type="image/png" href="/v0.3/favicons/android-72x72.png" sizes="72x72"><link rel="icon" type="image/png" href="/v0.3/favicons/android-96x196.png" sizes="96x196"><link rel="icon" type="image/png" href="/v0.3/favicons/android-144x144.png" sizes="144x144"><link rel="icon" type="image/png" href="/v0.3/favicons/android-192x192.png" sizes="192x192"><link rel="manifest" href="/v0.3/manifest.json"><meta name="apple-mobile-web-app-title" content="Istio"><meta name="application-name" content="Istio"><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic"><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"><link rel="stylesheet" href="/v0.3/css/all.css"><link rel="stylesheet" href="/v0.3/css/prism.css"></head><body class="language-unknown"> <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script><div class="nav-hero-container" style="z-index: 200000;"><nav id="header-nav" class="navbar navbar-inverse" role="navigation" style="z-index: 200000;"><div class="container"><div class="row"><div class="col-md-11 nofloat center-block "><div class="navbar-header"> <button type="button" class="hamburger navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar-collapse-1" aria-expanded="false"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand" href="/v0.3/"><div> <img src="/v0.3/img/istio-logo.svg" alt="Istio Logo" height="54px"/> <span class="brand-name">Istioldie 0.3</span></div></a></div><div class="collapse navbar-collapse" id="navbar-collapse-1"><ul class="nav navbar-nav navbar-right"><li><a href="/v0.3/about" >About</a></li><li><a href="/v0.3/blog" >Blog</a></li><li><a href="/v0.3/docs/welcome" class='current'>Docs</a></li><li><a href="/v0.3/help" >Help</a></li><li><a href="/v0.3/community" >Community</a></li><li class="dropdown"> <a class="dropdown-toggle" data-toggle="dropdown" href=""> <i class='fa fa-lg fa-cog'></i> <span class="caret"></span> </a><ul class="dropdown-menu"><h6 class="dropdown-header">Other versions of this site</h6><li> <a href="https://istio.io">Current Release</a></li><li> <a href="https://preliminary.istio.io">Next Release</a></li><li> <a href="https://archive.istio.io">Older Releases</a></li></ul></li><li><form name="cse" id="searchbox_demo" class="navbar-form navbar-right" role="search"> <input type="hidden" name="cx" value="013699703217164175118:iwwf17ikgf4" /> <input type="hidden" name="ie" value="utf-8" /> <input type="hidden" name="hl" value="en" /><div class="form-group"><div class="input-group"> <input name="q" class="form-control search-box" type="text" size="30" /><div class="input-group-addon"> <span class="btn-search glyphicon glyphicon-search"></span></div></div></div></form> <script type="text/javascript" src="https://www.google.com/cse/brand?form=searchbox_demo"></script></li></ul></div></div></div></div></nav></div><div class="container"><div class="row"><div class="col-md-11 nofloat center-block" style="margin-top: 3px;"><ul class="col-sm-10 nav nav-tabs"><li role="presentation" class='active'><a href="/v0.3/docs/welcome/">Welcome</a></li><li role="presentation" ><a href="/v0.3/docs/concepts/">Concepts</a></li><li role="presentation" ><a href="/v0.3/docs/setup/">Setup</a></li><li role="presentation" ><a href="/v0.3/docs/tasks/">Tasks</a></li><li role="presentation" ><a href="/v0.3/docs/guides/">Guides</a></li><li role="presentation" ><a href="/v0.3/docs/reference/">Reference</a></li></ul></div></div></div><script src="/v0.3/js/navtree.min.js"></script><div class="container docs"><div class="row"><div class="col-md-11 nofloat center-block"><div class="row"><div id="sidebar-container" class="col-sm-3"><ul class="doc-side-nav"><li><h5 class='doc-side-nav-title'>Welcome</h5></li><script type="text/javascript"> var docs = []; docs.push({path: [ "contribute", "creating-a-pull-request.md", ], url: "/docs/welcome/contribute/creating-a-pull-request.html", title: "Creating a Pull Request", order: 20, overview: "Shows you how to create a GitHub pull request in order to submit your docs for approval."}); docs.push({path: [ "contribute", "editing.md", ], url: "/docs/welcome/contribute/editing.html", title: "Editing Docs", order: 10, overview: "Lets you start editing this site's documentation."}); docs.push({path: [ "contribute", "index.md", ], url: "/docs/welcome/contribute/", title: "Contributing to the Docs", order: 100, overview: "Learn how to contribute to improve and expand the Istio documentation."}); docs.push({path: [ "contribute", "reviewing-doc-issues.md", ], url: "/docs/welcome/contribute/reviewing-doc-issues.html", title: "Doc Issues", order: 60, overview: "Explains the process involved in accepting documentation updates."}); docs.push({path: [ "contribute", "staging-your-changes.md", ], url: "/docs/welcome/contribute/staging-your-changes.html", title: "Staging Your Changes", order: 40, overview: "Explains how to test your changes locally before submitting them."}); docs.push({path: [ "contribute", "style-guide.md", ], url: "/docs/welcome/contribute/style-guide.html", title: "Style Guide", order: 70, overview: "Explains the dos and donts of writing Istio docs."}); docs.push({path: [ "contribute", "writing-a-new-topic.md", ], url: "/docs/welcome/contribute/writing-a-new-topic.html", title: "Writing a New Topic", order: 30, overview: "Explains the mechanics of creating new documentation pages."}); docs.push({path: [ "faq.md", ], url: "/docs/welcome/faq.html", title: "Frequently Asked Questions", order: 20, overview: "Frequently Asked Questions about Istio."}); docs.push({path: [ "feature-stages.md", ], url: "/docs/welcome/feature-stages.html", title: "Feature Status", order: 10, overview: "List of features and their release stages."}); docs.push({path: [ "glossary.md", ], url: "/docs/welcome/glossary.html", title: "Glossary", order: 30, overview: "A glossary of common Istio terms."}); docs.push({path: [ "index.md", ], url: "/docs/welcome/", title: "Welcome", order: 0, overview: "Istio documentation home page."}); docs.push({path: [ "notes", "0.1.md", ], url: "/docs/welcome/notes/0.1.html", title: "Istio 0.1", order: 100, overview: ""}); docs.push({path: [ "notes", "0.2.md", ], url: "/docs/welcome/notes/0.2.html", title: "Istio 0.2", order: 99, overview: ""}); docs.push({path: [ "notes", "0.3.md", ], url: "/docs/welcome/notes/0.3.html", title: "Istio 0.3", order: 98, overview: ""}); docs.push({path: [ "notes", "index.md", ], url: "/docs/welcome/notes/", title: "Release Notes", order: 5, overview: "What's been happening with Istio."}); genNavBarTree(docs) </script></ul></div><div id="tab-container" class="col-xs-1 tab-neg-margin pull-left"> <a id="sidebar-tab" class="glyphicon glyphicon-chevron-left" href="javascript:void 0;"> </a></div><div id="content-container" class="thin-left-border col-sm-9 markdown"><div id="doc-content"><h1>Frequently Asked Questions</h1><script src="/v0.3/js/faq.min.js"></script><div class="faq"><p>Here are some frequently asked questions about Istio.</p><blockquote><p><img src="/v0.3/img/bulb.png" alt="Bulb" title="Help" style="width: 32px; display:inline" /> If you don’t find what you’re looking for here, check out our <a href="/v0.3/help">help page</a>.</p></blockquote><div class="container"><div class="col-md-2"><ul class="list-group help-group"><div class="faq-list list-group nav nav-tabs"> <a href="#tab1" class="list-group-item active" role="tab" data-toggle="tab">General</a> <a href="#tab2" class="list-group-item " role="tab" data-toggle="tab">Setup</a> <a href="#tab3" class="list-group-item " role="tab" data-toggle="tab">Security</a> <a href="#tab4" class="list-group-item " role="tab" data-toggle="tab">Mixer</a> <a href="#tab5" class="list-group-item " role="tab" data-toggle="tab">Traffic Management</a></div></ul></div><div class="col-md-8"><div class="tab-content panels-faq"><div class="tab-pane active" id="tab1"><div class="panel-group" id="faq-accordion-1"><div id="what-is-istio" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse2"><div class="panel-heading"><h4>What is Istio?</h4></div></a><div id="collapse2" class="panel-collapse collapse"><div class="panel-body"><p>Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection.</p><p><em>Open</em>: Istio is being developed and maintained as open-source software. We encourage contributions and feedback from the community at-large.</p><p><em>Platform-independent</em>: Istio is not targeted at any specific deployment environment. During the initial stages of development, Istio will support Kubernetes-based deployments. However, Istio is being built to enable rapid and easy adaptation to other environments.</p><p><em>Service mesh</em>: Istio is designed to manage communications between microservices and applications. Without requiring changes to the underlying services, Istio provides automated baseline traffic resilience, service metrics collection, distributed tracing, traffic encryption, protocol upgrades, and advanced routing functionality for all service-to-service communication.</p><p>For more detail, please see: <a href="/v0.3/docs/concepts/what-is-istio/">What is Istio?</a></p></div></div></div><div id="why-use-istio" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse7"><div class="panel-heading"><h4>Why would I want to use Istio?</h4></div></a><div id="collapse7" class="panel-collapse collapse"><div class="panel-body"><p>Traditionally, much of the logic handled by Istio has been built directly into applications. Across a fleet of services, managing updates to this communications logic can be a large burden. Istio provides an infrastructure-level solution to managing service communications.</p><p><em>Application developers</em>: With Istio managing how traffic flows across their services, developers can focus exclusively on business logic and iterate quickly on new features.</p><p><em>Service operators</em>: Istio enables policy enforcement and mesh monitoring from a single centralized control point, independent of application evolution. As a result, operators can ensure continuous policy compliance through a simplified management plane.</p></div></div></div><div id="how-do-i-get-started" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse12"><div class="panel-heading"><h4>How do I get started using Istio?</h4></div></a><div id="collapse12" class="panel-collapse collapse"><div class="panel-body"><p>We recommend starting with the <a href="/v0.3/docs/guides/">Guides</a>, which walks through different core Istio concepts in a tutorial style. The guides show case intelligent routing, policy enforcement, security, telemetry, etc.</p><p>To start using Istio on your existing Kubernetes or Consul deployment, please refer to our <a href="/v0.3/docs/setup/">Installation</a> task guide.</p></div></div></div><div id="what-is-the-license" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse17"><div class="panel-heading"><h4>What is the license?</h4></div></a><div id="collapse17" class="panel-collapse collapse"><div class="panel-body"><p>Istio uses the <a href="https://www.apache.org/licenses/LICENSE-2.0.html">Apache License 2.0</a>.</p></div></div></div><div id="how-was-istio-started" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse22"><div class="panel-heading"><h4>How was Istio started?</h4></div></a><div id="collapse22" class="panel-collapse collapse"><div class="panel-body"><p>The Istio project was started by teams from Google and IBM in partnership with the Envoy team from Lyft. It’s been developed fully in the open on GitHub.</p></div></div></div><div id="what-deployment-environment" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse25"><div class="panel-heading"><h4>What deployment environments are supported?</h4></div></a><div id="collapse25" class="panel-collapse collapse"><div class="panel-body"><p>Istio is designed and built to be platform-independent. For our 0.3 release, Istio supports environments running container orchestration platforms such as Kubernetes (v1.7.4 or greater) and Nomad (with Consul).</p></div></div></div><div id="how-do-i-contribute" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse28"><div class="panel-heading"><h4>How can I contribute?</h4></div></a><div id="collapse28" class="panel-collapse collapse"><div class="panel-body"><p>Contributions are highly welcome. We look forward to community feedback, additions, and bug reports.</p><p>The code repositories are hosted on <a href="https://github.com/istio">GitHub</a>. Please see our<a href="https://github.com/istio/community/blob/master/CONTRIBUTING.md">Contribution Guidelines</a> to learn how to contribute.</p><p>In addition to the code, there are other ways to contribute to the Istio <a href="/v0.3/community">community</a>, including on <a href="https://stackoverflow.com/questions/tagged/istio">Stack Overflow</a>, and the <a href="https://groups.google.com/forum/#!forum/istio-users">mailing list</a>.</p></div></div></div><div id="istio-partners-and-vendors" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse30"><div class="panel-heading"><h4>How can I discover more about Partner and Vendor opportunities?</h4></div></a><div id="collapse30" class="panel-collapse collapse"><div class="panel-body"><p>If you’d like to speak to the Istio team about a potential integration and/or a partnership opportunity, please complete this <a href="https://goo.gl/forms/ax2SdpC6FpVh9Th02">form</a>.</p></div></div></div><div id="where-is-the-documentation" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse31"><div class="panel-heading"><h4>Where is the documentation?</h4></div></a><div id="collapse31" class="panel-collapse collapse"><div class="panel-body"><p>Check out the <a href="/v0.3/docs/">documentation</a> right here on istio.io. The docs include <a href="/v0.3/docs/concepts/">concept overviews</a>, <a href="/v0.3/docs/tasks/">task guides</a>, <a href="/v0.3/docs/guides/">guides</a>, and the <a href="/v0.3/docs/reference/">complete reference documentation</a>.</p><p>Detailed developer-level documentation is maintained for each component in GitHub, alongside the code. Please visit each repository for those docs:</p><ul><li><p><a href="https://envoyproxy.github.io/envoy/">Envoy</a></p></li><li><p><a href="https://github.com/istio/istio/tree/master/pilot/doc">Pilot</a></p></li><li><p><a href="https://github.com/istio/istio/tree/master/mixer/doc">Mixer</a></p></li></ul></div></div></div><div id="istio-doesnt-work" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse32"><div class="panel-heading"><h4>Istio doesn't work - what do I do?</h4></div></a><div id="collapse32" class="panel-collapse collapse"><div class="panel-body"><p>Check out the <a href="/v0.3/troubleshooting">troubleshooting guide</a> for finding solutions and our <a href="/v0.3/bugs">bug reporting</a> page for filing bugs.</p></div></div></div><div id="roadmap" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse35"><div class="panel-heading"><h4>What is Istio's roadmap?</h4></div></a><div id="collapse35" class="panel-collapse collapse"><div class="panel-body"><p>See our <a href="/v0.3/docs/welcome/feature-stages.html">feature stages page</a> and <a href="/v0.3/docs/welcome/notes">release notes</a> for more details.</p></div></div></div><div id="what-does-istio-mean" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-1" href="#collapse36"><div class="panel-heading"><h4>What does the word 'Istio' mean?</h4></div></a><div id="collapse36" class="panel-collapse collapse"><div class="panel-body"><p>It’s the Greek word for ‘sail’.</p></div></div></div></div></div><div class="tab-pane " id="tab2"><div class="panel-group" id="faq-accordion-2"><div id="k8s-checking-cluster-alpha-features" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse5"><div class="panel-heading"><h4>Kubernetes - How do I check if my cluster has enabled the alpha features required for automatic sidecar injection?</h4></div></a><div id="collapse5" class="panel-collapse collapse"><div class="panel-body"><p>Automatic sidecar injection requires the <a href="https://kubernetes.io/docs/admin/extensible-admission-controllers/#enable-initializers-alpha-feature">initializer alpha feature</a>. Run the following command to check if the initializer has been enabled (empty output indicates that initializers are not enabled):</p><pre><code class="language-bash">kubectl api-versions | grep admissionregistration
|
||
</code></pre><p>In addition, the Kubernetes API server must be started with the Initializer plugin <a href="https://kubernetes.io/docs/admin/extensible-admission-controllers/#enable-initializers-alpha-feature">enabled</a>. Failure to enable the <code>Initializer</code> plugin will result in the following error when trying to create the initializer deployment.</p><blockquote><p>The Deployment “istio-initializer” is invalid: metadata.initializers.pending: Invalid value: “null”: must be non-empty when result is not set</p></blockquote></div></div></div><div id="k8s-sidecar-injection-not-working" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse10"><div class="panel-heading"><h4>Kubernetes - How can I debug problems with automatic sidecar injection?</h4></div></a><div id="collapse10" class="panel-collapse collapse"><div class="panel-body"><p>Ensure that your cluster has met the <a href="/v0.3/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection">prerequisites</a> for the automatic sidecar injection. If your microservice is deployed in kube-system, kube-public or istio-system namespaces, they are exempted from automatic sidecar injection. Please use a different namespace instead.</p></div></div></div><div id="k8s-migrating" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse15"><div class="panel-heading"><h4>Kubernetes - Can I migrate an existing installation from Istio v0.1.x to v0.2.x?</h4></div></a><div id="collapse15" class="panel-collapse collapse"><div class="panel-body"><p>Upgrading from Istio 0.1.x to 0.2.x is not supported. You must uninstall Istio v0.1, <em>including pods with Istio sidecars</em> and start with a fresh install of Istio v0.2.</p></div></div></div><div id="consul-app-not-working" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse20"><div class="panel-heading"><h4>Consul - My application isn't working, where can I troubleshoot this?</h4></div></a><div id="collapse20" class="panel-collapse collapse"><div class="panel-body"><p>Please ensure all required containers are running: etcd, istio-apiserver, consul, registrator, pilot. If one of them is not running, you may find the {containerID} using <code>docker ps -a</code> and then use <code>docker logs {containerID}</code> to read the logs.</p></div></div></div><div id="consul-unset-context" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse24"><div class="panel-heading"><h4>Consul - How do I unset the context changed by istioctl at the end?</h4></div></a><div id="collapse24" class="panel-collapse collapse"><div class="panel-body"><p>Your <code>kubectl</code> is switched to use the istio context at the end of the <code>istio context-create</code> command. You can use <code>kubectl config get-contexts</code> to obtain the list of contexts and <code>kubectl config use-context {desired-context}</code> to switch to use your desired context.</p></div></div></div><div id="eureka-app-not-working" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse27"><div class="panel-heading"><h4>Eureka - My application isn't working, where can I troubleshoot this?</h4></div></a><div id="collapse27" class="panel-collapse collapse"><div class="panel-body"><p>Please ensure all required containers are running: etcd, istio-apiserver, consul, registrator, istio-pilot. If one of them is not running, you may find the {containerID} using <code>docker ps -a</code> and then use <code>docker logs {containerID}</code> to read the logs.</p></div></div></div><div id="eureka-unset-context" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-2" href="#collapse29"><div class="panel-heading"><h4>Eureka - How do I unset the context changed by `istioctl` at the end?</h4></div></a><div id="collapse29" class="panel-collapse collapse"><div class="panel-body"><p>Your <code>kubectl</code> is switched to use the istio context at the end of the <code>istio context-create</code> command. You can use <code>kubectl config get-contexts</code> to obtain the list of contexts and <code>kubectl config use-context {desired-context}</code> to switch to use your desired context.</p></div></div></div></div></div><div class="tab-pane " id="tab3"><div class="panel-group" id="faq-accordion-3"><div id="enabling-disabling-mtls" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse4"><div class="panel-heading"><h4>How can I enable/disable mTLS encryption after I installed Istio?</h4></div></a><div id="collapse4" class="panel-collapse collapse"><div class="panel-body"><p>The most straightforward way to enable/disable mTLS is by entirely uninstalling and re-installing Istio.</p><p>If you are an advanced user and understand the risks you can also do the following:</p><pre><code class="language-bash">kubectl edit configmap -n istio-system istio
|
||
</code></pre><p>comment out or uncomment out <code>authPolicy: MUTUAL_TLS</code> to toggle mTLS and then</p><pre><code class="language-bash">kubectl delete pods -n istio-system -l istio=pilot
|
||
</code></pre><p>to restart Pilot, after a few seconds (depending on your <code>*RefreshDelay</code>) your Envoy proxies will have picked up the change from Pilot. During that time your services may be unavailable.</p><p>We are working on a smoother solution.</p></div></div></div><div id="istio-to-not-istio" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse9"><div class="panel-heading"><h4>Can a service with Istio Auth enabled communicate with a service without Istio?</h4></div></a><div id="collapse9" class="panel-collapse collapse"><div class="panel-body"><p>This is not supported currently, but will be in the near future.</p></div></div></div><div id="auth-mix-and-match" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse14"><div class="panel-heading"><h4>Can I enable Istio Auth with some services while disable others in the same cluster?</h4></div></a><div id="collapse14" class="panel-collapse collapse"><div class="panel-body"><p>Starting with release 0.3, you can use service-level annotations to disable (or enable) Istio Auth for particular service-port. The annotation key should be <code>auth.istio.io/{port_number}</code>, and the value should be <code>NONE</code> (to disable), or <code>MUTUAL_TLS</code> (to enable).</p><p>Example: disable Istio Auth on port 9080 for service <code>details</code>.</p><pre><code class="language-yaml">kind: Service
|
||
metadata:
|
||
name: details
|
||
labels:
|
||
app: details
|
||
annotations:
|
||
auth.istio.io/9080: NONE
|
||
</code></pre></div></div></div><div id="k8s-health-checks" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse19"><div class="panel-heading"><h4>How can I use Kubernetes liveness and readiness for service health check with Istio Auth enabled?</h4></div></a><div id="collapse19" class="panel-collapse collapse"><div class="panel-body"><p>If Istio Auth is enabled, http and tcp health check from kubelet will not work since they do not have Istio Auth issued certs. A workaround is to use a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#define-a-liveness-command">liveness command</a> for health check, e.g., one can install curl in the service pod and curl itself within the pod. The Istio team is actively working on a solution.</p><p>An example of readinessProbe:</p><pre><code class="language-yaml">livenessProbe:
|
||
exec:
|
||
command:
|
||
- curl
|
||
- -f
|
||
- http://localhost:8080/healthz # Replace port and URI by your actual health check
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 5
|
||
</code></pre></div></div></div><div id="k8s-api-server" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse23"><div class="panel-heading"><h4>Can I access the Kubernetes API Server with Auth enabled?</h4></div></a><div id="collapse23" class="panel-collapse collapse"><div class="panel-body"><p>The Kubernetes API server does not support mutual TLS authentication, so strictly speaking: no. However, if you use version 0.3 or later, see next question to learn how to disable mTLS in upstream config on clients side so they can access API server.</p></div></div></div><div id="accessing-control-services" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse26"><div class="panel-heading"><h4>How to disable Auth on clients to access the Kubernetes API Server (or any control services that don't have Istio sidecar)?</h4></div></a><div id="collapse26" class="panel-collapse collapse"><div class="panel-body"><p>Starting with release 0.3, edit the <code>mtlsExcludedServices</code> list in Istio config map to contain the fully-qualified name of the API server (and any other control services for that matter). The default value of <code>mtlsExcludedServices</code> already contains <code>kubernetes.default.svc.cluster.local</code>, which is the default service name of the Kubernetes API server.</p><p>For a quick reference, here are commands to edit Istio configmap and to restart pilot.</p><pre><code class="language-bash">kubectl edit configmap -n istio-system istio
|
||
kubectl delete pods -n istio-system -l istio=pilot
|
||
</code></pre><blockquote><p>Note: DO NOT use this approach to disable mTLS for services that are managed by Istio (i.e. using Istio sidecar). Instead, use service-level annotations to overwrite the authentication policy (see above).</p></blockquote></div></div></div><div id="does-istio-support-authorization" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse33"><div class="panel-heading"><h4>Does Istio Auth support authorization?</h4></div></a><div id="collapse33" class="panel-collapse collapse"><div class="panel-body"><p>Not currently - but we are working on it. At the moment, we only support the kubernetes service account as the principal identity in Istio Auth. We are investigating using <a href="https://jwt.io/">JWT</a> together with mutual TLS to support enhanced authentication and authorization.</p></div></div></div><div id="use-k8s-secrets" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-3" href="#collapse34"><div class="panel-heading"><h4>Does Istio Auth use Kubernetes secrets?</h4></div></a><div id="collapse34" class="panel-collapse collapse"><div class="panel-body"><p>Yes. The key and certificate distribution in Istio Auth is based on <a href="https://kubernetes.io/docs/concepts/configuration/secret/">Kubernetes secrets</a>.</p><p>Secrets have known <a href="https://kubernetes.io/docs/concepts/configuration/secret/#risks">security risks</a>. The kubernetes team is working on <a href="https://docs.google.com/document/d/1T2y-9geg9EfHHtCDYTXptCa-F4kQ0RyiH-c_M1SyD0s">several features</a> to improve Kubernetes secret security, from secret encryption to node-level access control. And as of version 1.6, Kubernetes introduces <a href="https://kubernetes.io/docs/admin/authorization/rbac/">RBAC authorization</a>, which can provide fine-grained secrets management.</p></div></div></div></div></div><div class="tab-pane " id="tab4"><div class="panel-group" id="faq-accordion-4"><div id="why-mixer" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-4" href="#collapse1"><div class="panel-heading"><h4>Why does Istio need Mixer?</h4></div></a><div id="collapse1" class="panel-collapse collapse"><div class="panel-body"><p>Mixer provides a rich intermediation layer between the Istio components as well as Istio-based services, and the infrastructure backends used to perform access control checks and telemetry capture. This layer enables operators to have rich insights and control over service behavior without requiring changes to service binaries.</p><p>Mixer is designed as a stand-alone component, distinct from Envoy. This has numerous benefits:</p><ul><li><p><em>Scalability</em>. The work that Mixer and Envoy do is very different in nature, leading to different scalability requirements. Keeping the components separate enables independent component-appropriate scaling.</p></li><li><p><em>Resource Usage</em>. Istio depends on being able to deploy many instances of its proxy, making it important to minimize the cost of each individual instance. Moving Mixer’s complex logic into a distinct component makes it possible for Envoy to remain svelte and agile.</p></li><li><p><em>Reliability</em>. Mixer and its open-ended extensibility model represents the most complex parts of the data path processing pipeline. By hosting this functionality in Mixer rather than Envoy, it creates distinct failure domains which enables Envoy to continue operating even if Mixer fails, preventing outages.</p></li><li><p><em>Isolation</em>. Mixer provides a level of insulation between Istio and the infrastructure backends. Each Envoy instance can be configured to have a very narrow scope of interaction, limiting the impact of potential attacks.</p></li><li><p><em>Extensibility</em>. It was imperative to design a simple extensibility model to allow Istio to interoperate with as widest breath of backends as possible. Due to its design and language choice, Mixer is inherently easier to extend than Envoy is. The separation of concerns also makes it possible to use Istio policy and telemetry processing with different proxies, just as a mix of Envoy and NGINX.</p></li></ul><p>Envoy implements sophisticated caching, batching, and prefetching, to largely mitigate the latency impact of needing to interact with Mixer on the request path.</p></div></div></div><div id="seeing-mixer-config" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-4" href="#collapse3"><div class="panel-heading"><h4>How do I see all of the configuration for Mixer?</h4></div></a><div id="collapse3" class="panel-collapse collapse"><div class="panel-body"><p>Configuration for <em>instances</em>, <em>handlers</em>, and <em>rules</em> is stored as Kubernetes <a href="https://kubernetes.io/docs/concepts/api-extension/custom-resources/">Custom Resources</a>. Configuration may be accessed by using <code>kubectl</code> to query the Kubernetes <a href="https://kubernetes.io/docs/admin/kube-apiserver/">API server</a> for the resources.</p><h4 id="rules">Rules</h4><p>To see the list of all rules, execute the following:</p><pre><code class="language-bash">kubectl get rules --all-namespaces
|
||
</code></pre><p>Output will be similar to:</p><pre><code>NAMESPACE NAME KIND
|
||
default mongoprom rule.v1alpha2.config.istio.io
|
||
istio-system promhttp rule.v1alpha2.config.istio.io
|
||
istio-system promtcp rule.v1alpha2.config.istio.io
|
||
istio-system stdio rule.v1alpha2.config.istio.io
|
||
</code></pre><p>To see an individual rule configuration, execute the following:</p><pre><code class="language-bash">kubectl -n <namespace> get rules <name> -o yaml
|
||
</code></pre><h4 id="handlers">Handlers</h4><p>Handlers are defined based on Kubernetes <a href="https://kubernetes.io/docs/concepts/api-extension/custom-resources/#customresourcedefinitions">Custom Resource Definitions</a> for adapters.</p><p>First, identify the list of adapter kinds:</p><pre><code class="language-bash">kubectl get crd -listio=mixer-adapter
|
||
</code></pre><p>The output will be similar to:</p><pre><code>NAME KIND
|
||
deniers.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
listcheckers.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
memquotas.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
noops.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
prometheuses.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
stackdrivers.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
statsds.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
stdios.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
svcctrls.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
</code></pre><p>Then, for each adapter kind in that list, issue the following command:</p><pre><code class="language-bash">kubectl get <adapter kind name> --all-namespaces
|
||
</code></pre><p>Output for <code>stdios</code> will be similar to:</p><pre><code>NAMESPACE NAME KIND
|
||
istio-system handler stdio.v1alpha2.config.istio.io
|
||
</code></pre><p>To see an individual handler configuration, execute the following:</p><pre><code class="language-bash">kubectl -n <namespace> get <adapter kind name> <name> -o yaml
|
||
</code></pre><h4 id="instances">Instances</h4><p>Instances are defined according to Kubernetes <a href="https://kubernetes.io/docs/concepts/api-extension/custom-resources/#customresourcedefinitions">Custom Resource Definitions</a> for instances.</p><p>First, identify the list of instance kinds:</p><pre><code class="language-bash">kubectl get crd -listio=mixer-instance
|
||
</code></pre><p>The output will be similar to:</p><pre><code>NAME KIND
|
||
checknothings.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
listentries.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
logentries.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
metrics.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
quotas.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
reportnothings.config.istio.io CustomResourceDefinition.v1beta1.apiextensions.k8s.io
|
||
</code></pre><p>Then, for each instance kind in that list, issue the following command:</p><pre><code class="language-bash">kubectl get <instance kind name> --all-namespaces
|
||
</code></pre><p>Output for <code>metrics</code> will be similar to:</p><pre><code>NAMESPACE NAME KIND
|
||
default mongoreceivedbytes metric.v1alpha2.config.istio.io
|
||
default mongosentbytes metric.v1alpha2.config.istio.io
|
||
istio-system requestcount metric.v1alpha2.config.istio.io
|
||
istio-system requestduration metric.v1alpha2.config.istio.io
|
||
istio-system requestsize metric.v1alpha2.config.istio.io
|
||
istio-system responsesize metric.v1alpha2.config.istio.io
|
||
istio-system tcpbytereceived metric.v1alpha2.config.istio.io
|
||
istio-system tcpbytesent metric.v1alpha2.config.istio.io
|
||
</code></pre><p>To see an individual instance configuration, execute the following:</p><pre><code class="language-bash">kubectl -n <namespace> get <instance kind name> <name> -o yaml
|
||
</code></pre></div></div></div><div id="attribute-expressions" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-4" href="#collapse8"><div class="panel-heading"><h4>What is the full set of attribute expressions Mixer supports?</h4></div></a><div id="collapse8" class="panel-collapse collapse"><div class="panel-body"><p>Please see the <a href="/v0.3/docs/reference/config/mixer/expression-language.html">Expression Language Reference</a> for the full set of supported attribute expressions.</p></div></div></div><div id="mixer-self-monitoring" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-4" href="#collapse13"><div class="panel-heading"><h4>Does Mixer provide any self-monitoring?</h4></div></a><div id="collapse13" class="panel-collapse collapse"><div class="panel-body"><p>Mixer exposes a monitoring endpoint (default port: <code>9093</code>). There are a few useful paths to investigate Mixer performance and audit function:</p><ul><li><code>/metrics</code> provides Prometheus metrics on the Mixer process as well as gRPC metrics related to API calls and metrics on adapter dispatch.</li><li><code>/debug/pprof</code> provides an endpoint for profiling data in <a href="https://golang.org/pkg/net/http/pprof/">pprof format</a>.</li><li><code>/debug/vars</code> provides an endpoint exposing server metrics in JSON format.</li></ul><p>Mixer logs can be accessed via a <code>kubectl logs</code> command, as follows:</p><pre><code class="language-bash">kubectl -n istio-system logs $(kubectl -n istio-system get pods -listio=mixer -o jsonpath='{.items[0].metadata.name}') mixer
|
||
</code></pre><p>Mixer trace generation is controlled by the command-line flag <code>traceOutput</code>. If the flag value is set to <code>STDOUT</code> or <code>STDERR</code> trace data will be written directly to those locations. If a URL is provided, Mixer will post Zipkin-formatted data to that endpoint (example: <code>http://zipkin:9411/api/v1/spans</code>).</p><p>In the 0.2 release, Mixer only supports Zipkin tracing.</p></div></div></div><div id="writing-custom-adapters" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-4" href="#collapse18"><div class="panel-heading"><h4>How can I write a custom adapter for Mixer?</h4></div></a><div id="collapse18" class="panel-collapse collapse"><div class="panel-body"><p>Learn how to implement a new adapter for Mixer by consulting the <a href="https://github.com/istio/istio/blob/master/mixer/doc/adapters.md">Adapter Developer’s Guide</a>.</p></div></div></div></div></div><div class="tab-pane " id="tab5"><div class="panel-group" id="faq-accordion-5"><div id="viewing-current-rules" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-5" href="#collapse6"><div class="panel-heading"><h4>How can I view the current route rules I have configured with Istio?</h4></div></a><div id="collapse6" class="panel-collapse collapse"><div class="panel-body"><p>Rules can be viewed using <code>istioctl get routerules -o yaml</code> or <code>kubectl get routerules -o yaml</code>.</p></div></div></div><div id="weighted-rules-not-working" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-5" href="#collapse11"><div class="panel-heading"><h4>Why is creating a weighted route rule to split traffic between two versions of a service not working as expected?</h4></div></a><div id="collapse11" class="panel-collapse collapse"><div class="panel-body"><p>For the current Envoy sidecar implementation, up to 100 requests may be required for the desired distribution to be observed.</p></div></div></div><div id="unreachable-services" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-5" href="#collapse16"><div class="panel-heading"><h4>How come some of my services are unreachable after creating route rules?</h4></div></a><div id="collapse16" class="panel-collapse collapse"><div class="panel-body"><p>This is an known issue with the current Envoy sidecar implementation. After two seconds of creating the rule, services should become available.</p></div></div></div><div id="ingress-with-no-route-rules" class="panel panel-default"> <a class="panel-title" data-toggle="collapse" data-parent="#faq-accordion-5" href="#collapse21"><div class="panel-heading"><h4>Can I use standard Ingress specification without any route rules?</h4></div></a><div id="collapse21" class="panel-collapse collapse"><div class="panel-body"><p>Simple ingress specifications, with host, TLS, and exact path based matches will work out of the box without the need for route rules. However, note that the path used in the ingress resource should not have any <code>.</code> characters.</p><p>For example, the following ingress resource matches requests for the example.com host, with /helloworld as the URL.</p><pre><code class="language-bash">cat <<EOF | kubectl create -f -
|
||
apiVersion: extensions/v1beta1
|
||
kind: Ingress
|
||
metadata:
|
||
name: simple-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: istio
|
||
spec:
|
||
rules:
|
||
- host: example.com
|
||
http:
|
||
paths:
|
||
- path: /helloworld
|
||
backend:
|
||
serviceName: myservice
|
||
servicePort: grpc
|
||
EOF
|
||
</code></pre><p>However, the following rules will not work because it uses regular expressions in the path and uses <code>ingress.kubernetes.io</code> annotations:</p><pre><code class="language-bash">cat <<EOF | kubectl create -f -
|
||
apiVersion: extensions/v1beta1
|
||
kind: Ingress
|
||
metadata:
|
||
name: this-will-not-work
|
||
annotations:
|
||
kubernetes.io/ingress.class: istio
|
||
# Ingress annotations other than ingress class will not be honored
|
||
ingress.kubernetes.io/rewrite-target: /
|
||
spec:
|
||
rules:
|
||
- host: example.com
|
||
http:
|
||
paths:
|
||
- path: /hello(.*?)world/
|
||
backend:
|
||
serviceName: myservice
|
||
servicePort: grpc
|
||
EOF
|
||
</code></pre></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><script src="/v0.3/js/sidemenu.min.js"></script><footer><div class="container"><div class="row"><div class="col-lg-2 col-md-2 col-sm-2"></div><div class="col-lg-3 col-md-3 col-sm-3 col-xs-12 center-block"><ul><li><a class="header" href="/v0.3/docs/welcome">Docs</a></li><li><a href="/v0.3/docs/concepts">Concepts</a></li><li><a href="/v0.3/docs/setup">Setup</a></li><li><a href="/v0.3/docs/tasks">Tasks</a></li><li><a href="/v0.3/docs/guides">Guides</a></li><li><a href="/v0.3/docs/reference">Reference</a></li></ul></div><div class="col-lg-3 col-md-3 col-sm-3 col-xs-12 center-block"><ul><li><a class="header" href="/v0.3/help">Help</a></li><li><a href="/v0.3/faq">FAQ</a></li><li><a href="/v0.3/glossary">Glossary</a></li><li><a href="/v0.3/troubleshooting">Troubleshooting</a></li><li><a href="/v0.3/bugs">Report Bugs</a></li><li><a href="https://github.com/istio/istio.github.io/issues/new?title=Issue with _docs/welcome/faq.md">Doc Bugs & Gaps</a></li><li><a href="https://github.com/istio/istio.github.io/edit/master/_docs/welcome/faq.md">Edit This Page</a></li></ul></div><div class="col-lg-3 col-md-3 col-sm-3 col-xs-12 center-block"><ul><li> <a class="header" href="/v0.3/community">Community</a></li><li> <a href="https://groups.google.com/forum/#!forum/istio-users" target="_blank" rel="noopener">User</a> | <a href="https://groups.google.com/forum/#!forum/istio-dev" target="_blank" rel="noopener">Dev Mailing Lists</a></li><li><a href="https://twitter.com/IstioMesh" target="_blank" rel="noopener">Twitter</a></li><li><a href="https://stackoverflow.com/questions/tagged/istio" target="_blank" rel="noopener">Stack Overflow</a></li><li><a href="https://github.com/istio/community" target="_blank" rel="noopener">GitHub</a></li><li><a href="https://github.com/istio/community/blob/master/WORKING-GROUPS.md" target="_blank" rel="noopener">Working Groups</a></li></ul></div><div class="col-lg-1 col-md-1 col-sm-1"></div></div><div class="row"><p class="description small text-center"> Istio 0.3, Copyright © 2017 Istio Authors<br> Archived on 08-Dec-2017</p></div></div></footer><script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/jquery.validate.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery.form/4.2.1/jquery.form.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-visible/1.2.0/jquery.visible.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/clipboard.min.js"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> <script src="/v0.3/js/common.min.js"></script> <script src="/v0.3/js/search.js"></script> <script src="/v0.3/js/prism.min.js"></script></body></html>
|