mirror of https://github.com/istio/istio.io.git
182 lines
69 KiB
HTML
182 lines
69 KiB
HTML
<!DOCTYPE html><html lang="en" itemscope itemtype="https://schema.org/WebPage"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><meta name="theme-color" content="#466BB0"/><meta name="title" content="Control Ingress Traffic"><meta name="description" content="Describes how to configure Istio to expose a service outside of the service mesh."><meta name="og:title" content="Control Ingress Traffic"><meta name="og:description" content="Describes how to configure Istio to expose a service outside of the service mesh."><meta name="og:url" content="/docs/tasks/traffic-management-v1alpha3/ingress.html"><meta name="og.site_name" content="Istio"><title>Istioldie 0.7 / Control Ingress Traffic</title><script> window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date; ga('create', 'UA-98480406-2', 'auto'); ga('send', 'pageview'); </script> <script async src='https://www.google-analytics.com/analytics.js'></script><link rel="alternate" type="application/rss+xml" title="Istio Blog RSS" href="/v0.7/feed.xml"><link rel="shortcut icon" href="/v0.7/favicons/favicon.ico" ><link rel="apple-touch-icon" href="/v0.7/favicons/apple-touch-icon-180x180.png" sizes="180x180"><link rel="icon" type="image/png" href="/v0.7/favicons/favicon-16x16.png" sizes="16x16"><link rel="icon" type="image/png" href="/v0.7/favicons/favicon-32x32.png" sizes="32x32"><link rel="icon" type="image/png" href="/v0.7/favicons/android-36x36.png" sizes="36x36"><link rel="icon" type="image/png" href="/v0.7/favicons/android-48x48.png" sizes="48x48"><link rel="icon" type="image/png" href="/v0.7/favicons/android-72x72.png" sizes="72x72"><link rel="icon" type="image/png" href="/v0.7/favicons/android-96x196.png" sizes="96x196"><link rel="icon" type="image/png" href="/v0.7/favicons/android-144x144.png" sizes="144x144"><link rel="icon" type="image/png" href="/v0.7/favicons/android-192x192.png" sizes="192x192"><link rel="manifest" href="/v0.7/manifest.json"><meta name="apple-mobile-web-app-title" content="Istio"><meta name="application-name" content="Istio"><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic"><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="sha384-Gn5384xqQ1aoWXA+058RXPxPg6fy4IWvTNh0E263XmFcJlSAwiGgFAW/dAiS6JXm" crossorigin="anonymous"><link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.0.6/css/all.css"><link rel="stylesheet" href="/v0.7/css/light_theme.css" title="light"><link rel="alternate stylesheet" href="/v0.7/css/dark_theme.css" title="dark"> <script src="/v0.7/js/styleSwitcher.min.js"></script></head><body class="language-unknown theme-unknown"><header role="banner"><nav class="navbar navbar-expand-sm navbar-dark fixed-top bg-dark justify-content-between"> <a class="navbar-brand" href="/v0.7/" style="visibility: visible"> <img class="logo" src="/v0.7/img/istio-logo.svg" alt="Istio Logo"/> <span class="brand-name">Istioldie 0.7</span> </a> <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarCollapse" aria-controls="navbarCollapse" aria-expanded="false" aria-label="Toggle navigation"> <span class="navbar-toggler-icon"></span> </button><div class="collapse navbar-collapse justify-content-end" id="navbarCollapse"><ul id="navbar-links" class="navbar-nav active"><li class="nav-item"> <a class="nav-link active" href="/v0.7/docs/">Docs</a></li><li class="nav-item"> <a class="nav-link " href="/v0.7/blog/2018/traffic-mirroring.html">Blog</a></li><li class="nav-item"> <a class="nav-link " href="/v0.7/help/">Help</a></li><li class="nav-item"> <a class="nav-link " href="/v0.7/community.html">Community</a></li><li class="nav-item"> <a class="nav-link " href="/v0.7/about/">About</a></li><li class="nav-item dropdown" id="gearDropdown" style="white-space: nowrap"> <a href="" class="nav-link" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i style="width: 1em" class='fa fa-lg fa-cog'></i> </a><ul class="dropdown-menu dropdown-menu-right" aria-labelledby="gearDropdown"><h6 class="dropdown-header">Other versions of this site</h6><li> <a href="https://istio.io">Current Release</a></li><li> <a href="https://preliminary.istio.io">Next Release</a></li><li> <a href="https://archive.istio.io">Older Releases</a></li><li class="dropdown-divider"></li><li> <i class='fa fa-check light'></i> <a href="" onclick="setActiveStyleSheet('light');return false;">Light Theme</a></li><li> <i class='fa fa-check dark'></i> <a href="" onclick="setActiveStyleSheet('dark');return false;">Dark Theme</a></li><li class="dropdown-divider"></li><li><a href="https://github.com/istio/istio.github.io/issues/new?title=Issue with _docs/tasks/traffic-management-v1alpha3/ingress.md">Report Site Bugs</a></li><li><a href="https://github.com/istio/istio.github.io/edit/master/_docs/tasks/traffic-management-v1alpha3/ingress.md">Edit this Page on GitHub</a></li></ul></li><li class="nav-item"> <a id="search_show" class="nav-link" href=""><i style="width: 1em" class="fa fa-lg fa-search"></i></a></li></ul><form name="cse" id="search_form" class="form-inline mr-sm-2" role="search"> <input type="hidden" name="cx" value="013699703217164175118:iwwf17ikgf4" /> <input type="hidden" name="ie" value="utf-8" /> <input type="hidden" name="hl" value="en" /> <input id="search_textbox" class="form-control" name="q" type="text" /> <button id="search_close" type="reset"><i class="far fa-lg fa-times-circle"></i></button> </form></div></nav></header><div class="container-fluid"><div class="row row-offcanvas row-offcanvas-left"><div class="col-6 col-md-3 col-xl-2 sidebar-offcanvas"><nav class="sidebar"><div class="spacer"></div><div class="directory" role="tablist"><div class="card"><div class="card-header" role="tab" id="header1"> <a data-toggle="collapse" href="#collapse1" title="Concepts help you learn about the different parts of the Istio system and the abstractions it uses." role="button" aria-controls="collapse1"><div> Concepts</div></a></div><div id="collapse1" class="collapse" data-parent="#sidebar" role="tabpanel" aria-labelledby="header1"><div class="card-body"><ul class="tree"><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="A broad overview of the Istio system." href="/v0.7/docs/concepts/what-is-istio">What is Istio?</a> </label><ul class="tree collapse"><li> <a title="Provides a conceptual introduction to Istio, including the problems it solves and its high-level architecture." href="/v0.7/docs/concepts/what-is-istio/overview.html">Overview</a></li><li> <a title="Describes the core principles that Istio's design adheres to." href="/v0.7/docs/concepts/what-is-istio/goals.html">Design Goals</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes the various Istio features focused on traffic routing and control." href="/v0.7/docs/concepts/traffic-management">Traffic Management</a> </label><ul class="tree collapse"><li> <a title="Provides a conceptual overview of traffic management in Istio and the features it enables." href="/v0.7/docs/concepts/traffic-management/overview.html">Overview</a></li><li> <a title="Introduces Pilot, the component responsible for managing a distributed deployment of Envoy proxies in the service mesh." href="/v0.7/docs/concepts/traffic-management/pilot.html">Pilot</a></li><li> <a title="Describes how requests are routed between services in an Istio service mesh." href="/v0.7/docs/concepts/traffic-management/request-routing.html">Request Routing</a></li><li> <a title="Describes how traffic is load balanced across instances of a service in the mesh." href="/v0.7/docs/concepts/traffic-management/load-balancing.html">Discovery & Load Balancing</a></li><li> <a title="An overview of failure recovery capabilities in Envoy that can be leveraged by unmodified applications to improve robustness and prevent cascading failures." href="/v0.7/docs/concepts/traffic-management/handling-failures.html">Handling Failures</a></li><li> <a title="Introduces the idea of systematic fault injection that can be used to uncover conflicting failure recovery policies across services." href="/v0.7/docs/concepts/traffic-management/fault-injection.html">Fault Injection</a></li><li> <a title="Provides a high-level overview of the domain-specific language used by Istio to configure traffic management rules in the service mesh." href="/v0.7/docs/concepts/traffic-management/rules-configuration.html">Rules Configuration</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes Istio's authorization and authentication functionality." href="/v0.7/docs/concepts/security">Security</a> </label><ul class="tree collapse"><li> <a title="Describes Istio RBAC which provides access control for services in Istio Mesh." href="/v0.7/docs/concepts/security/rbac.html">Istio Role-Based Access Control (RBAC)</a></li><li> <a title="Describes Istio's mutual TLS authentication architecture which provides a strong service identity and secure communication channels between services." href="/v0.7/docs/concepts/security/mutual-tls.html">Mutual TLS Authentication</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Introduces the policy control mechanisms." href="/v0.7/docs/concepts/policy-and-control">Policies and Control</a> </label><ul class="tree collapse"><li> <a title="Explains the important notion of attributes, which is a central mechanism for how policies and control are applied to services within the mesh." href="/v0.7/docs/concepts/policy-and-control/attributes.html">Attributes</a></li><li> <a title="Architectural deep-dive into the design of Mixer, which provides the policy and control mechanisms within the service mesh." href="/v0.7/docs/concepts/policy-and-control/mixer.html">Mixer</a></li><li> <a title="An overview of the key concepts used to configure Mixer." href="/v0.7/docs/concepts/policy-and-control/mixer-config.html">Mixer Configuration</a></li></ul></li></ul></div></div></div><div class="card"><div class="card-header" role="tab" id="header20"> <a data-toggle="collapse" href="#collapse20" title="Setup contains instructions for installing the Istio control plane in various environments (e.g., Kubernetes, Consul, etc.), as well as instructions for installing the sidecar in the application deployment." role="button" aria-controls="collapse20"><div> Setup</div></a></div><div id="collapse20" class="collapse" data-parent="#sidebar" role="tabpanel" aria-labelledby="header20"><div class="card-body"><ul class="tree"><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Instructions for installing the Istio control plane on Kubernetes and adding VMs into the mesh." href="/v0.7/docs/setup/kubernetes">Kubernetes</a> </label><ul class="tree collapse"><li> <a title="Quick Start instructions to setup the Istio service mesh in a Kubernetes cluster." href="/v0.7/docs/setup/kubernetes/quick-start.html">Quick Start</a></li><li> <a title="Quick Start instructions to setup the Istio service using Google Kubernetes Engine (GKE)" href="/v0.7/docs/setup/kubernetes/quick-start-gke-dm.html">Quick Start with Google Kubernetes Engine</a></li><li> <a title="Install Istio with the included Helm chart." href="/v0.7/docs/setup/kubernetes/helm-install.html">Installation with Helm</a></li><li> <a title="Install Itio with the included Ansible playbook." href="/v0.7/docs/setup/kubernetes/ansible-install.html">Installation with Ansible</a></li><li> <a title="Instructions for installing the Istio sidecar in application pods automatically using the sidecar injector webhook or manually using istioctl CLI." href="/v0.7/docs/setup/kubernetes/sidecar-injection.html">Installing the Istio Sidecar</a></li><li> <a title="Instructions for integrating VMs and bare metal hosts into an Istio mesh deployed on Kubernetes." href="/v0.7/docs/setup/kubernetes/mesh-expansion.html">Istio Mesh Expansion</a></li><li> <a title="This guide demonstrates how to upgrade the Istio control plane and data plane independently." href="/v0.7/docs/setup/kubernetes/upgrading-istio.html">Upgrading Istio</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Instructions for installing the Istio control plane in a Consul based environment, with or without Nomad." href="/v0.7/docs/setup/consul">Nomad & Consul</a> </label><ul class="tree collapse"><li> <a title="Quick Start instructions to setup the Istio service mesh with Docker Compose." href="/v0.7/docs/setup/consul/quick-start.html">Quick Start on Docker</a></li><li> <a title="Instructions for installing the Istio control plane in a Consul based environment, with or without Nomad." href="/v0.7/docs/setup/consul/install.html">Installation</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Instructions for installing the Istio control plane in a Eureka based environment." href="/v0.7/docs/setup/eureka">Eureka</a> </label><ul class="tree collapse"><li> <a title="Quick Start instructions to setup the Istio service mesh with Docker Compose." href="/v0.7/docs/setup/eureka/quick-start.html">Quick Start on Docker</a></li><li> <a title="Instructions for installing the Istio control plane in an Eureka based environment." href="/v0.7/docs/setup/eureka/install.html">Installation</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Instructions for installing the Istio control plane in Cloud Foundry." href="/v0.7/docs/setup/cloudfoundry">Cloud Foundry</a> </label><ul class="tree collapse"><li> <a title="Instructions for installing the Istio control plane in Cloud Foundry." href="/v0.7/docs/setup/cloudfoundry/install.html">Installation</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Instructions for installing the Istio control plane in Apache Mesos." href="/v0.7/docs/setup/mesos">Mesos</a> </label><ul class="tree collapse"><li> <a title="Instructions for installing the Istio control plane in Apache Mesos." href="/v0.7/docs/setup/mesos/install.html">Installation</a></li></ul></li></ul></div></div></div><div class="card"><div class="card-header" role="tab" id="header39"> <a data-toggle="collapse" href="#collapse39" title="Tasks show you how to do a single specific targeted activity with the Istio system." role="button" aria-controls="collapse39"><div> Tasks</div></a></div><div id="collapse39" class="collapse show" data-parent="#sidebar" role="tabpanel" aria-labelledby="header39"><div class="card-body"><ul class="tree"><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes tasks that demonstrate traffic routing features of Istio service mesh." href="/v0.7/docs/tasks/traffic-management">Traffic Management</a> </label><ul class="tree collapse"><li> <a title="This task shows you how to configure dynamic request routing based on weights and HTTP headers." href="/v0.7/docs/tasks/traffic-management/request-routing.html">Configuring Request Routing</a></li><li> <a title="This task shows how to inject delays and test the resiliency of your application." href="/v0.7/docs/tasks/traffic-management/fault-injection.html">Fault Injection</a></li><li> <a title="This task shows you how to migrate traffic from an old to new version of a service." href="/v0.7/docs/tasks/traffic-management/traffic-shifting.html">Traffic Shifting</a></li><li> <a title="This task shows you how to setup request timeouts in Envoy using Istio." href="/v0.7/docs/tasks/traffic-management/request-timeouts.html">Setting Request Timeouts</a></li><li> <a title="Describes how to configure Istio Ingress on Kubernetes." href="/v0.7/docs/tasks/traffic-management/ingress.html">Istio Ingress</a></li><li> <a title="Describes how to configure Istio to route traffic from services in the mesh to external services." href="/v0.7/docs/tasks/traffic-management/egress.html">Control Egress Traffic</a></li><li> <a title="Describes how to configure Istio to route TCP traffic from services in the mesh to external services." href="/v0.7/docs/tasks/traffic-management/egress-tcp.html">Control Egress TCP Traffic</a></li><li> <a title="This task demonstrates the circuit-breaking capability for resilient applications" href="/v0.7/docs/tasks/traffic-management/circuit-breaking.html">Circuit Breaking</a></li><li> <a title="Demonstrates Istio's traffic shadowing/mirroring capabilities" href="/v0.7/docs/tasks/traffic-management/mirroring.html">Mirroring</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-down'></i> <a class="" title="WIP - Describes tasks that demonstrate traffic routing features of Istio service mesh." href="/v0.7/docs/tasks/traffic-management-v1alpha3">Traffic Management (v1alpha3)</a> </label><ul class="tree"><li> <a title="This task shows you how to configure dynamic request routing based on weights and HTTP headers." href="/v0.7/docs/tasks/traffic-management-v1alpha3/request-routing.html">Configuring Request Routing</a></li><li> <a title="This task shows how to inject delays and test the resiliency of your application." href="/v0.7/docs/tasks/traffic-management-v1alpha3/fault-injection.html">Fault Injection</a></li><li> <a title="This task shows you how to migrate traffic from an old to new version of a service." href="/v0.7/docs/tasks/traffic-management-v1alpha3/traffic-shifting.html">Traffic Shifting</a></li><li> <a title="This task shows you how to setup request timeouts in Envoy using Istio." href="/v0.7/docs/tasks/traffic-management-v1alpha3/request-timeouts.html">Setting Request Timeouts</a></li><li> <span class="current" title="Describes how to configure Istio to expose a service outside of the service mesh.">Control Ingress Traffic</span></li><li> <a title="Describes how to configure Istio to route traffic from services in the mesh to external services." href="/v0.7/docs/tasks/traffic-management-v1alpha3/egress.html">Control Egress Traffic</a></li><li> <a title="Describes how to configure Istio to route TCP traffic from services in the mesh to external services." href="/v0.7/docs/tasks/traffic-management-v1alpha3/egress-tcp.html">Control Egress TCP Traffic</a></li><li> <a title="This task demonstrates the circuit-breaking capability for resilient applications" href="/v0.7/docs/tasks/traffic-management-v1alpha3/circuit-breaking.html">Circuit Breaking</a></li><li> <a title="This task demonstrates the traffic shadowing/mirroring capabilities of Istio" href="/v0.7/docs/tasks/traffic-management-v1alpha3/mirroring.html">Mirroring</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes tasks that demonstrate policy enforcement features." href="/v0.7/docs/tasks/policy-enforcement">Policy Enforcement</a> </label><ul class="tree collapse"><li> <a title="This task shows you how to use Istio to dynamically limit the traffic to a service." href="/v0.7/docs/tasks/policy-enforcement/rate-limiting.html">Enabling Rate Limits</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes tasks that demonstrate how to collect telemetry information from the service mesh." href="/v0.7/docs/tasks/telemetry">Metrics, Logs, and Traces</a> </label><ul class="tree collapse"><li> <a title="How to configure the proxies to send tracing requests to Zipkin or Jaeger" href="/v0.7/docs/tasks/telemetry/distributed-tracing.html">Distributed Tracing</a></li><li> <a title="This task shows you how to configure Istio to collect metrics and logs." href="/v0.7/docs/tasks/telemetry/metrics-logs.html">Collecting Metrics and Logs</a></li><li> <a title="This task shows you how to configure Istio to collect metrics for TCP services." href="/v0.7/docs/tasks/telemetry/tcp-metrics.html">Collecting Metrics for TCP services</a></li><li> <a title="This task shows you how to query for Istio Metrics using Prometheus." href="/v0.7/docs/tasks/telemetry/querying-metrics.html">Querying Metrics from Prometheus</a></li><li> <a title="This task shows you how to setup and use the Istio Dashboard to monitor mesh traffic." href="/v0.7/docs/tasks/telemetry/using-istio-dashboard.html">Visualizing Metrics with Grafana</a></li><li> <a title="This task shows you how to generate a graph of services within an Istio mesh." href="/v0.7/docs/tasks/telemetry/servicegraph.html">Generating a Service Graph</a></li><li> <a title="This task shows you how to configure Istio to log to a Fluentd daemon" href="/v0.7/docs/tasks/telemetry/fluentd.html">Logging with Fluentd</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes tasks that help securing the service mesh traffic." href="/v0.7/docs/tasks/security">Security</a> </label><ul class="tree collapse"><li> <a title="This task shows you how to verify and test Istio's automatic mutual TLS authentication." href="/v0.7/docs/tasks/security/mutual-tls.html">Testing Istio mutual TLS authentication</a></li><li> <a title="This task shows how to control access to a service using the Kubernetes labels." href="/v0.7/docs/tasks/security/basic-access-control.html">Setting up Basic Access Control</a></li><li> <a title="This task shows how to securely control access to a service using service accounts." href="/v0.7/docs/tasks/security/secure-access-control.html">Setting up Secure Access Control</a></li><li> <a title="This task shows how to set up role-based access control for services in Istio mesh." href="/v0.7/docs/tasks/security/role-based-access-control.html">Setting up Istio Role-Based Access Control</a></li><li> <a title="This task shows how to change mutual TLS authentication for a single service." href="/v0.7/docs/tasks/security/per-service-mtls.html">Per-service mutual TLS authentication enablement</a></li><li> <a title="This task shows how operators can plug existing certificate and key into Istio CA." href="/v0.7/docs/tasks/security/plugin-ca-cert.html">Plugging in CA certificate and key</a></li><li> <a title="This task shows how to enable Istio CA health check." href="/v0.7/docs/tasks/security/health-check.html">Enabling Istio CA health check</a></li></ul></li></ul></div></div></div><div class="card"><div class="card-header" role="tab" id="header78"> <a data-toggle="collapse" href="#collapse78" title="Guides include a variety of fully working example uses for Istio that you can experiment with." role="button" aria-controls="collapse78"><div> Guides</div></a></div><div id="collapse78" class="collapse" data-parent="#sidebar" role="tabpanel" aria-labelledby="header78"><div class="card-body"><ul class="tree"><li> <a title="This guide deploys a sample application composed of four separate microservices which will be used to demonstrate various features of the Istio service mesh." href="/v0.7/docs/guides/bookinfo.html">Bookinfo</a></li><li> <a title="This guide demonstrates how to use various traffic management capabilities of an Istio service mesh." href="/v0.7/docs/guides/intelligent-routing.html">Intelligent Routing</a></li><li> <a title="This sample demonstrates how to obtain uniform metrics, logs, traces across different services using Istio Mixer and Istio sidecar." href="/v0.7/docs/guides/telemetry.html">In-Depth Telemetry</a></li><li> <a title="This sample deploys the Bookinfo services across Kubernetes and a set of virtual machines, and illustrates how to use the Istio service mesh to control this infrastructure as a single mesh." href="/v0.7/docs/guides/integrating-vms.html">Integrating Virtual Machines</a></li></ul></div></div></div><div class="card"><div class="card-header" role="tab" id="header83"> <a data-toggle="collapse" href="#collapse83" title="The Reference section contains detailed authoritative reference material such as command-line options, configuration options, and API calling parameters." role="button" aria-controls="collapse83"><div> Reference</div></a></div><div id="collapse83" class="collapse" data-parent="#sidebar" role="tabpanel" aria-labelledby="header83"><div class="card-body"><ul class="tree"><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Detailed information on API parameters." href="/v0.7/docs/reference/api">API</a> </label><ul class="tree collapse"><li> <a title="API definitions to interact with Mixer" href="/v0.7/docs/reference/api/istio.mixer.v1.html">Mixer</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Detailed information on configuration options." href="/v0.7/docs/reference/config">Configuration</a> </label><ul class="tree collapse"><li> <a title="Configuration state for the Mixer client library" href="/v0.7/docs/reference/config/istio.mixer.v1.config.client.html">Mixer Client</a></li><li> <a title="Configuration affecting resource-based access control" href="/v0.7/docs/reference/config/istio.rbac.v1alpha1.html">RBAC</a></li><li> <a title="Configuration affecting traffic routing" href="/v0.7/docs/reference/config/istio.routing.v1alpha1.html">Route Rules Alpha 1</a></li><li> <a title="Configuration affecting traffic routing" href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html">Route Rules Alpha 3</a></li><li> <a title="Configuration affecting the service mesh as a whole" href="/v0.7/docs/reference/config/istio.mesh.v1alpha1.html">Service Mesh</a></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Detailed information on configuration and API exposed by Mixer." href="/v0.7/docs/reference/config/mixer">Mixer</a> </label><ul class="tree collapse"><li> <a title="Definitions used to create adapters and templates" href="/v0.7/docs/reference/config/mixer/istio.mixer.adapter.model.v1beta1.html">Mixer Adapter Model</a></li><li> <a title="Describes the base attribute vocabulary used for policy and control." href="/v0.7/docs/reference/config/mixer/attribute-vocabulary.html">Attribute Vocabulary</a></li><li> <a title="Mixer config expression language reference." href="/v0.7/docs/reference/config/mixer/expression-language.html">Expression Language</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Generated documentation for Mixer's adapters." href="/v0.7/docs/reference/config/adapters">Adapters</a> </label><ul class="tree collapse"><li> <a title="Adapter for circonus.com's monitoring solution." href="/v0.7/docs/reference/config/adapters/circonus.html">Circonus</a></li><li> <a title="Adapter to deliver metrics to a dogstatsd agent for delivery to DataDog" href="/v0.7/docs/reference/config/adapters/datadog.html">Datadog</a></li><li> <a title="Adapter that always returns a precondition denial." href="/v0.7/docs/reference/config/adapters/denier.html">Denier</a></li><li> <a title="Adapter that delivers logs to a fluentd daemon." href="/v0.7/docs/reference/config/adapters/fluentd.html">Fluentd</a></li><li> <a title="Adapter that extracts information from a Kubernetes environment." href="/v0.7/docs/reference/config/adapters/kubernetesenv.html">Kubernetes Env</a></li><li> <a title="Adapter that performs whitelist or blacklist checks" href="/v0.7/docs/reference/config/adapters/list.html">List</a></li><li> <a title="Adapter for a simple in-memory quota management system." href="/v0.7/docs/reference/config/adapters/memquota.html">Memory quota</a></li><li> <a title="Adapter that implements an Open Policy Agent engine" href="/v0.7/docs/reference/config/adapters/opa.html">OPA</a></li><li> <a title="Adapter that exposes Istio metrics for ingestion by a Prometheus harvester." href="/v0.7/docs/reference/config/adapters/prometheus.html">Prometheus</a></li><li> <a title="Adapter that exposes Istio's Role-Based Access Control model." href="/v0.7/docs/reference/config/adapters/rbac.html">RBAC</a></li><li> <a title="Adapter for a Redis-based quota management system." href="/v0.7/docs/reference/config/adapters/redisquota.html">Redis Quota</a></li><li> <a title="Adapter that delivers logs and metrics to Google Service Control" href="/v0.7/docs/reference/config/adapters/servicecontrol.html">Service Control</a></li><li> <a title="Adapter to deliver logs and metrics to Papertrail and AppOptics backends" href="/v0.7/docs/reference/config/adapters/solarwinds.html">SolarWinds</a></li><li> <a title="Adapter to deliver logs and metrics to Stackdriver" href="/v0.7/docs/reference/config/adapters/stackdriver.html">Stackdriver</a></li><li> <a title="Adapter to deliver metrics to a StatsD backend" href="/v0.7/docs/reference/config/adapters/statsd.html">StatsD</a></li><li> <a title="Adapter for outputting logs and metrics locally." href="/v0.7/docs/reference/config/adapters/stdio.html">Stdio</a></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Generated documentation for Mixer's Templates." href="/v0.7/docs/reference/config/template">Templates</a> </label><ul class="tree collapse"><li> <a title="A template that represents a single API key." href="/v0.7/docs/reference/config/template/apikey.html">API Key</a></li><li> <a title="A template used to represent an access control query." href="/v0.7/docs/reference/config/template/authorization.html">Authorization</a></li><li> <a title="A template that carries no data, useful for testing." href="/v0.7/docs/reference/config/template/checknothing.html">Check Nothing</a></li><li> <a title="A template that is used to control the production of Kubernetes-specific attributes." href="/v0.7/docs/reference/config/template/kubernetes.html">Kubernetes</a></li><li> <a title="A template designed to let you perform list checking operations." href="/v0.7/docs/reference/config/template/listentry.html">List Entry</a></li><li> <a title="A template that represents a single runtime log entry." href="/v0.7/docs/reference/config/template/logentry.html">Log Entry</a></li><li> <a title="A template that represents a single runtime metric." href="/v0.7/docs/reference/config/template/metric.html">Metric</a></li><li> <a title="A template that represents a quota allocation request" href="/v0.7/docs/reference/config/template/quota.html">Quota</a></li><li> <a title="A template that carries no data, useful for testing." href="/v0.7/docs/reference/config/template/reportnothing.html">Report Nothing</a></li><li> <a title="A template used by the Google Service Control adapter." href="/v0.7/docs/reference/config/template/servicecontrolreport.html">Service Control Report</a></li></ul></li></ul></li><li class="sublist"> <label class='tree-toggle'> <i class='fa fa-lg fa-caret-right'></i> <a class="" title="Describes usage and options of the Istio commands and utilities." href="/v0.7/docs/reference/commands">Commands</a> </label><ul class="tree collapse"><li> <a title="Istio Certificate Authority (CA)" href="/v0.7/docs/reference/commands/istio_ca.html">istio_ca</a></li><li> <a title="Istio control interface" href="/v0.7/docs/reference/commands/istioctl.html">istioctl</a></li><li> <a title="Utility to trigger direct calls to Mixer's API." href="/v0.7/docs/reference/commands/mixc.html">mixc</a></li><li> <a title="Mixer is Istio's abstraction on top of infrastructure backends." href="/v0.7/docs/reference/commands/mixs.html">mixs</a></li><li> <a title="Istio security per-node agent" href="/v0.7/docs/reference/commands/node_agent.html">node_agent</a></li><li> <a title="Istio Pilot agent" href="/v0.7/docs/reference/commands/pilot-agent.html">pilot-agent</a></li><li> <a title="Istio Pilot" href="/v0.7/docs/reference/commands/pilot-discovery.html">pilot-discovery</a></li><li> <a title="Kubernetes webhook for automatic Istio sidecar injection" href="/v0.7/docs/reference/commands/sidecar-injector.html">sidecar-injector</a></li></ul></li><li> <a title="How to write Istio config YAML content." href="/v0.7/docs/reference/writing-config.html">Writing Configuration</a></li></ul></div></div></div></div></nav></div><div class="col-12 col-md-9 col-lg-7 col-xl-8"><p class="d-md-none"> <label class="sidebar-toggler" data-toggle="offcanvas"> <i class="fa fa-chevron-right"></i> </label></p><main role="main"><h1>Control Ingress Traffic</h1><p>In a Kubernetes environment, the <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Kubernetes Ingress Resource</a> allows users to specify services that should be exposed outside the cluster. For traffic entering an Istio service mesh, however, an Istio-aware <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-controllers">ingress controller</a> is needed to allow Istio features, for example, monitoring and route rules, to be applied to traffic entering the cluster.</p><p>Istio provides an envoy-based ingress controller that implements very limited support for standard Kubernetes <code class="highlighter-rouge">Ingress</code> resources as well as full support for an alternative specification, <a href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html#Gateway">Istio Gateway</a>. Using a <code class="highlighter-rouge">Gateway</code> is the recommended approach for configuring ingress traffic for Istio services. It is significantly more functional, not to mention the only option for non-Kubernetes environments.</p><p>This task describes how to configure Istio to expose a service outside of the service mesh using either specification.</p><h2 id="before-you-begin">Before you begin</h2><ul><li><p>Setup Istio by following the instructions in the <a href="/v0.7/docs/setup/">Installation guide</a>.</p></li><li><p>Make sure your current directory is the <code class="highlighter-rouge">istio</code> directory.</p></li><li><p>Start the <a href="https://github.com/istio/istio/tree/master/samples/httpbin">httpbin</a> sample, which will be used as the destination service to be exposed externally.</p><p>If you installed the <a href="/v0.7/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection">Istio-Initializer</a>, do</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl apply <span class="nt">-f</span> samples/httpbin/httpbin.yaml
|
||
</code></pre></div></div><p>Without the Istio-Initializer:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl apply <span class="nt">-f</span> <<span class="o">(</span>istioctl kube-inject <span class="nt">-f</span> samples/httpbin/httpbin.yaml<span class="o">)</span>
|
||
</code></pre></div></div></li><li><p>Generate a certificate and key that will be used to demonstrate a TLS-secured gateway</p><p>A private key and certificate can be created for testing using <a href="https://www.openssl.org/">OpenSSL</a>.</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code> openssl req <span class="nt">-x509</span> <span class="nt">-nodes</span> <span class="nt">-days</span> 365 <span class="nt">-newkey</span> rsa:2048 <span class="nt">-keyout</span> /tmp/tls.key <span class="nt">-out</span> /tmp/tls.crt <span class="nt">-subj</span> <span class="s2">"/CN=foo.bar.com"</span>
|
||
</code></pre></div></div></li></ul><h2 id="configuring-ingress-using-an-istio-gateway-resource-recommended">Configuring ingress using an Istio Gateway resource (recommended)</h2><blockquote><p>This is still a work in progress and is <strong>not available</strong> in the most recent Istio release (0.7.1). The current way of enabling inbound cluster traffic via Kubernetes Ingress resource is outlined <a href="#configuring-ingress-using-a-kubernetes-ingress-resource">below</a>.</p></blockquote><p>An <a href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html#Gateway">Istio Gateway</a> is the preferred model for configuring ingress traffic in Istio. An ingress <code class="highlighter-rouge">Gateway</code> describes a load balancer operating at the edge of the mesh receiving incoming HTTP/TCP connections. It configures exposed ports, protocols, etc., but, unlike <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Kubernetes Ingress Resources</a>, does not include any traffic routing configuration. Traffic routing for ingress traffic is instead configured using Istio routing rules, exactly in the same way as for internal service requests.</p><h3 id="configuring-a-gateway">Configuring a Gateway</h3><ol><li><p>Create an Istio <code class="highlighter-rouge">Gateway</code></p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cat</span> <span class="o"><<</span><span class="no">EOF</span><span class="sh"> | kubectl create -f -
|
||
apiVersion: networking.istio.io/v1alpha3
|
||
kind: Gateway
|
||
metadata:
|
||
name: httpbin-gateway
|
||
spec:
|
||
servers:
|
||
- port:
|
||
number: 80
|
||
name: http
|
||
- port:
|
||
number: 443
|
||
name: https
|
||
tls:
|
||
mode: SIMPLE
|
||
serverCertificate: /tmp/tls.crt
|
||
privateKey: /tmp/tls.key
|
||
</span><span class="no">EOF
|
||
</span></code></pre></div></div><p>Notice that a single <code class="highlighter-rouge">Gateway</code> specification can configure multiple ports, a simple HTTP (port 80) and secure HTTPS (port 443) in our case.</p></li><li><p>Configure routes for traffic entering via the <code class="highlighter-rouge">Gateway</code></p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cat</span> <span class="o"><<</span><span class="no">EOF</span><span class="sh"> | kubectl create -f -
|
||
apiVersion: networking.istio.io/v1alpha3
|
||
kind: VirtualService
|
||
metadata:
|
||
name: httpbin
|
||
spec:
|
||
hosts:
|
||
- httpbin
|
||
gateways:
|
||
- httpbin-gateway
|
||
http:
|
||
- match:
|
||
uri:
|
||
prefix: /status
|
||
route:
|
||
- destination:
|
||
port:
|
||
number: 8000
|
||
name: httpbin
|
||
- match:
|
||
uri:
|
||
prefix: /delay
|
||
route:
|
||
- destination:
|
||
port:
|
||
number: 8000
|
||
name: httpbin
|
||
</span><span class="no">EOF
|
||
</span></code></pre></div></div><p>Here we’ve created a <a href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html#VirtualService">VirtualService</a> configuration for the <code class="highlighter-rouge">httpbin</code> service, containing two route rules that allow traffic for paths <code class="highlighter-rouge">/status</code> and <code class="highlighter-rouge">/delay</code>. The <a href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html#VirtualService.gateways">gateways</a> list specifies that only requests through our <code class="highlighter-rouge">httpbin-gateway</code> are allowed. All other external requests will be rejected with a 404 response.</p><p>Note that in this configuration internal requests from other services in the mesh are not subject to these rules, but instead will simply default to round-robin routing. To apply these (or other rules) to internal calls, we could add the special value <code class="highlighter-rouge">mesh</code> to the list of <code class="highlighter-rouge">gateways</code>.</p></li></ol><h3 id="verifying-a-gateway">Verifying a Gateway</h3><p>The proxy instances implementing a particular <code class="highlighter-rouge">Gateway</code> configuration can be specified using a <a href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html#Gateway.selector">selector</a> field. If not specified, as in our case, the <code class="highlighter-rouge">Gateway</code> will be implemented by the default <code class="highlighter-rouge">istio-ingress</code> controller. Therefore, to test our <code class="highlighter-rouge">Gateway</code> we will send requests to the <code class="highlighter-rouge">istio-ingress</code> service.</p><ol><li><p>Get the ingress controller pod’s hostIP:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl <span class="nt">-n</span> istio-system get po <span class="nt">-l</span> <span class="nv">istio</span><span class="o">=</span>ingress <span class="nt">-o</span> <span class="nv">jsonpath</span><span class="o">=</span><span class="s1">'{.items[0].status.hostIP}'</span>
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>169.47.243.100
|
||
</code></pre></div></div></li><li><p>Get the istio-ingress service’s nodePorts for port 80 and 443:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl <span class="nt">-n</span> istio-system get svc istio-ingress
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>NAME CLUSTER-IP EXTERNAL-IP PORT<span class="o">(</span>S<span class="o">)</span> AGE
|
||
istio-ingress 10.10.10.155 <pending> 80:31486/TCP,443:32254/TCP 32m
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">export </span><span class="nv">INGRESS_HOST</span><span class="o">=</span>169.47.243.100:31486
|
||
<span class="nb">export </span><span class="nv">SECURE_INGRESS_HOST</span><span class="o">=</span>169.47.243.100:32254
|
||
</code></pre></div></div></li><li><p>Access the httpbin service with either HTTP or HTTPS using <em>curl</em>:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> http://<span class="nv">$INGRESS_HOST</span>/status/200
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 200 OK
|
||
server: envoy
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
content-type: text/html; charset=utf-8
|
||
access-control-allow-origin: *
|
||
access-control-allow-credentials: true
|
||
content-length: 0
|
||
x-envoy-upstream-service-time: 48
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> <span class="nt">-k</span> https://<span class="nv">$SECURE_INGRESS_HOST</span>/status/200
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 200 OK
|
||
server: envoy
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
content-type: text/html; charset=utf-8
|
||
access-control-allow-origin: *
|
||
access-control-allow-credentials: true
|
||
content-length: 0
|
||
x-envoy-upstream-service-time: 96
|
||
</code></pre></div></div></li><li><p>Access any other URL that has not been explicitly exposed. You should see a HTTP 404 error:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> http://<span class="nv">$INGRESS_HOST</span>/headers
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 404 Not Found
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
server: envoy
|
||
content-length: 0
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> https://<span class="nv">$SECURE_INGRESS_HOST</span>/headers
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 404 Not Found
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
server: envoy
|
||
content-length: 0
|
||
</code></pre></div></div></li></ol><h2 id="configuring-ingress-using-a-kubernetes-ingress-resource">Configuring ingress using a Kubernetes Ingress resource</h2><p>An Istio <code class="highlighter-rouge">Ingress</code> specification is based on the standard <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Kubernetes Ingress Resource</a> specification, with the following differences:</p><ol><li><p>Istio <code class="highlighter-rouge">Ingress</code> specification contains a <code class="highlighter-rouge">kubernetes.io/ingress.class: istio</code> annotation.</p></li><li><p>All other annotations are ignored.</p></li><li><p>Path syntax is <a href="http://en.cppreference.com/w/cpp/regex/ecmascript">c++11 regex format</a></p></li></ol><p>Note that <code class="highlighter-rouge">Ingress</code> traffic is not affected by routing rules configured for a backend (i.e., an Istio <code class="highlighter-rouge">VirtualService</code> cannot be combined with an <code class="highlighter-rouge">Ingress</code> specification). Traffic splitting, fault injection, mirroring, header match, etc., will not work for ingress traffic. A <code class="highlighter-rouge">DestinationRule</code> associated with the backend service will, however, work as expected.</p><p>The <code class="highlighter-rouge">servicePort</code> field in the <code class="highlighter-rouge">Ingress</code> specification can take a port number (integer) or a name. The port name must follow the Istio port naming conventions (e.g., <code class="highlighter-rouge">grpc-*</code>, <code class="highlighter-rouge">http2-*</code>, <code class="highlighter-rouge">http-*</code>, etc.) in order to function properly. The name used must match the port name in the backend service declaration.</p><h3 id="configuring-simple-ingress">Configuring simple Ingress</h3><ol><li><p>Create a basic <code class="highlighter-rouge">Ingress</code> specification for the httpbin service</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cat</span> <span class="o"><<</span><span class="no">EOF</span><span class="sh"> | kubectl create -f -
|
||
apiVersion: extensions/v1beta1
|
||
kind: Ingress
|
||
metadata:
|
||
name: simple-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: istio
|
||
spec:
|
||
rules:
|
||
- http:
|
||
paths:
|
||
- path: /status/*
|
||
backend:
|
||
serviceName: httpbin
|
||
servicePort: 8000
|
||
- path: /delay/*
|
||
backend:
|
||
serviceName: httpbin
|
||
servicePort: 8000
|
||
</span><span class="no">EOF
|
||
</span></code></pre></div></div></li></ol><h3 id="verifying-simple-ingress">Verifying simple Ingress</h3><ol><li><p>Determine the ingress URL:</p><ul><li><p>If your cluster is running in an environment that supports external load balancers, use the ingress’ external address:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl get ingress simple-ingress <span class="nt">-o</span> wide
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>NAME HOSTS ADDRESS PORTS AGE
|
||
simple-ingress <span class="k">*</span> 130.211.10.121 80 1d
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">export </span><span class="nv">INGRESS_HOST</span><span class="o">=</span>130.211.10.121
|
||
</code></pre></div></div></li><li><p>If load balancers are not supported, use the ingress controller pod’s hostIP:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl <span class="nt">-n</span> istio-system get po <span class="nt">-l</span> <span class="nv">istio</span><span class="o">=</span>ingress <span class="nt">-o</span> <span class="nv">jsonpath</span><span class="o">=</span><span class="s1">'{.items[0].status.hostIP}'</span>
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>169.47.243.100
|
||
</code></pre></div></div><p>along with the istio-ingress service’s nodePort for port 80:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl <span class="nt">-n</span> istio-system get svc istio-ingress
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>NAME CLUSTER-IP EXTERNAL-IP PORT<span class="o">(</span>S<span class="o">)</span> AGE
|
||
istio-ingress 10.10.10.155 <pending> 80:31486/TCP,443:32254/TCP 32m
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">export </span><span class="nv">INGRESS_HOST</span><span class="o">=</span>169.47.243.100:31486
|
||
</code></pre></div></div></li></ul></li><li><p>Access the httpbin service using <em>curl</em>:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> http://<span class="nv">$INGRESS_HOST</span>/status/200
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 200 OK
|
||
server: envoy
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
content-type: text/html; charset=utf-8
|
||
access-control-allow-origin: *
|
||
access-control-allow-credentials: true
|
||
content-length: 0
|
||
x-envoy-upstream-service-time: 48
|
||
</code></pre></div></div></li><li><p>Access any other URL that has not been explicitly exposed. You should see a HTTP 404 error</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> http://<span class="nv">$INGRESS_HOST</span>/headers
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 404 Not Found
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
server: envoy
|
||
content-length: 0
|
||
</code></pre></div></div></li></ol><h3 id="configuring-secure-ingress-https">Configuring secure Ingress (HTTPS)</h3><ol><li><p>Create a Kubernetes <code class="highlighter-rouge">Secret</code> to hold the key/cert</p><p>Create the secret <code class="highlighter-rouge">istio-ingress-certs</code> in namespace <code class="highlighter-rouge">istio-system</code> using <code class="highlighter-rouge">kubectl</code>. The Istio ingress controller will automatically load the secret.</p><blockquote><p>Note: the secret MUST be called <code class="highlighter-rouge">istio-ingress-certs</code> in the <code class="highlighter-rouge">istio-system</code> namespace, or it will not be mounted and available to the Istio ingress controller.</p></blockquote><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl create <span class="nt">-n</span> istio-system secret tls istio-ingress-certs <span class="nt">--key</span> /tmp/tls.key <span class="nt">--cert</span> /tmp/tls.crt
|
||
</code></pre></div></div><p>Note that by default all service accounts in the <code class="highlighter-rouge">istio-system</code> namespace can access this ingress key/cert, which risks leaking the key/cert. You can change the Role-Based Access Control (RBAC) rules to protect them. See (Link TBD) for details.</p></li><li><p>Create the <code class="highlighter-rouge">Ingress</code> specification for the httpbin service</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cat</span> <span class="o"><<</span><span class="no">EOF</span><span class="sh"> | kubectl create -f -
|
||
apiVersion: extensions/v1beta1
|
||
kind: Ingress
|
||
metadata:
|
||
name: secure-ingress
|
||
annotations:
|
||
kubernetes.io/ingress.class: istio
|
||
spec:
|
||
tls:
|
||
- secretName: istio-ingress-certs # currently ignored
|
||
rules:
|
||
- http:
|
||
paths:
|
||
- path: /status/*
|
||
backend:
|
||
serviceName: httpbin
|
||
servicePort: 8000
|
||
- path: /delay/*
|
||
backend:
|
||
serviceName: httpbin
|
||
servicePort: 8000
|
||
</span><span class="no">EOF
|
||
</span></code></pre></div></div><blockquote><p>Note: Because SNI is not yet supported, Envoy currently only allows a single TLS secret in the ingress. That means the secretName field in ingress resource is not used.</p></blockquote></li></ol><h3 id="verifying-secure-ingress">Verifying secure Ingress</h3><ol><li><p>Determine the ingress URL:</p><ul><li><p>If your cluster is running in an environment that supports external load balancers, use the ingress’ external address:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl get ingress secure-ingress <span class="nt">-o</span> wide
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>NAME HOSTS ADDRESS PORTS AGE
|
||
secure-ingress <span class="k">*</span> 130.211.10.121 80 1d
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">export </span><span class="nv">SECURE_INGRESS_HOST</span><span class="o">=</span>130.211.10.121
|
||
</code></pre></div></div></li><li><p>If load balancers are not supported, use the ingress controller pod’s hostIP:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl <span class="nt">-n</span> istio-system get po <span class="nt">-l</span> <span class="nv">istio</span><span class="o">=</span>ingress <span class="nt">-o</span> <span class="nv">jsonpath</span><span class="o">=</span><span class="s1">'{.items[0].status.hostIP}'</span>
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>169.47.243.100
|
||
</code></pre></div></div><p>along with the istio-ingress service’s nodePort for port 443:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl <span class="nt">-n</span> istio-system get svc istio-ingress
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>NAME CLUSTER-IP EXTERNAL-IP PORT<span class="o">(</span>S<span class="o">)</span> AGE
|
||
istio-ingress 10.10.10.155 <pending> 80:31486/TCP,443:32254/TCP 32m
|
||
</code></pre></div></div><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">export </span><span class="nv">SECURE_INGRESS_HOST</span><span class="o">=</span>169.47.243.100:32254
|
||
</code></pre></div></div></li></ul></li><li><p>Access the httpbin service using <em>curl</em>:</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> <span class="nt">-k</span> https://<span class="nv">$SECURE_INGRESS_HOST</span>/status/200
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 200 OK
|
||
server: envoy
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
content-type: text/html; charset=utf-8
|
||
access-control-allow-origin: *
|
||
access-control-allow-credentials: true
|
||
content-length: 0
|
||
x-envoy-upstream-service-time: 96
|
||
</code></pre></div></div></li><li><p>Access any other URL that has not been explicitly exposed. You should see a HTTP 404 error</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-I</span> <span class="nt">-k</span> https://<span class="nv">$SECURE_INGRESS_HOST</span>/headers
|
||
</code></pre></div></div><div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>HTTP/1.1 404 Not Found
|
||
date: Mon, 29 Jan 2018 04:45:49 GMT
|
||
server: envoy
|
||
content-length: 0
|
||
</code></pre></div></div></li></ol><h2 id="understanding-what-happened">Understanding what happened</h2><p><code class="highlighter-rouge">Gateway</code> or <code class="highlighter-rouge">Ingress</code> configuration resources allow external traffic to enter the Istio service mesh and make the traffic management and policy features of Istio available for edge services.</p><p>In the preceding steps we created a service inside the Istio service mesh and showed how to expose both HTTP and HTTPS endpoints of the service to external traffic. Using an Istio <code class="highlighter-rouge">Gateway</code> provides significantly more functionality and is recommended. Using a Kubernetes <code class="highlighter-rouge">Ingress</code>, however, is also supported and may be especially useful when moving existing Kubernetes applications to Istio.</p><h2 id="cleanup">Cleanup</h2><ol><li><p>Remove the <code class="highlighter-rouge">Gateway</code> configuration.</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl delete gateway httpbin-gateway
|
||
</code></pre></div></div></li><li><p>Remove the <code class="highlighter-rouge">Ingress</code> configuration.</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl delete ingress simple-ingress secure-ingress
|
||
</code></pre></div></div></li><li><p>Remove the routing rule and secret.</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>istioctl delete virtualservice httpbin
|
||
kubectl delete <span class="nt">-n</span> istio-system secret istio-ingress-certs
|
||
</code></pre></div></div></li><li><p>Shutdown the <a href="https://github.com/istio/istio/tree/master/samples/httpbin">httpbin</a> service.</p><div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl delete <span class="nt">-f</span> samples/httpbin/httpbin.yaml
|
||
</code></pre></div></div></li></ol><h2 id="whats-next">What’s next</h2><ul><li><p>Learn more about <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Ingress Control</a>.</p></li><li><p>Learn more about <a href="/v0.7/docs/reference/config/istio.networking.v1alpha3.html">Traffic Routing</a>.</p></li></ul></main></div><div class="col-12 col-md-2 d-none d-lg-block"><nav class="toc"><div class="spacer"></div><div class="directory" role="directory"><ul><li><a href="#before-you-begin">Before you begin</a></li><li><a href="#configuring-ingress-using-an-istio-gateway-resource-recommended">Configuring ingress using an Istio Gateway resource (recommended)</a><ul><li><a href="#configuring-a-gateway">Configuring a Gateway</a></li><li><a href="#verifying-a-gateway">Verifying a Gateway</a></li></ul></li><li><a href="#configuring-ingress-using-a-kubernetes-ingress-resource">Configuring ingress using a Kubernetes Ingress resource</a><ul><li><a href="#configuring-simple-ingress">Configuring simple Ingress</a></li><li><a href="#verifying-simple-ingress">Verifying simple Ingress</a></li><li><a href="#configuring-secure-ingress-https">Configuring secure Ingress (HTTPS)</a></li><li><a href="#verifying-secure-ingress">Verifying secure Ingress</a></li></ul></li><li><a href="#understanding-what-happened">Understanding what happened</a></li><li><a href="#cleanup">Cleanup</a></li><li><a href="#whats-next">What’s next</a></li></ul></div></nav></div></div></div><div class="footer"><footer><div class="container-fluid"><div class="row"><div class="col-6 col-lg-4" role="navigation"><div class="container-fluid"><div class="row justify-content-start"><div class="icon"> <a title="Join the istio-users@ mailing list to participate in discussions and get help troubleshooting problems" href="https://groups.google.com/forum/#!forum/istio-users"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 490 490"><path d="M480,410.248H10c-5.523,0-10-4.477-10-10V89.752c0-5.523,4.477-10,10-10h470c5.522,0,10,4.477,10,10v310.495 C490,405.771,485.522,410.248,480,410.248z M20,390.248h450V99.752H20V390.248z"/><path d="M245,286.131c-2.083,0-4.167-0.649-5.931-1.948L48.64,143.929c-4.446-3.275-5.396-9.535-2.121-13.982 c3.275-4.447,9.535-5.396,13.982-2.121L245,263.712l184.5-135.886c4.447-3.274,10.709-2.326,13.982,2.121 c3.275,4.447,2.325,10.707-2.121,13.982L250.931,284.183C249.167,285.482,247.083,286.131,245,286.131z"/> </svg> </a></div><div class="icon"> <a title="Follow us on Twitter to get the latest news" href="https://twitter.com/IstioMesh"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 310 310"><path d="M302.973,57.388c-4.87,2.16-9.877,3.983-14.993,5.463c6.057-6.85,10.675-14.91,13.494-23.73 c0.632-1.977-0.023-4.141-1.648-5.434c-1.623-1.294-3.878-1.449-5.665-0.39c-10.865,6.444-22.587,11.075-34.878,13.783 c-12.381-12.098-29.197-18.983-46.581-18.983c-36.695,0-66.549,29.853-66.549,66.547c0,2.89,0.183,5.764,0.545,8.598 C101.163,99.244,58.83,76.863,29.76,41.204c-1.036-1.271-2.632-1.956-4.266-1.825c-1.635,0.128-3.104,1.05-3.93,2.467 c-5.896,10.117-9.013,21.688-9.013,33.461c0,16.035,5.725,31.249,15.838,43.137c-3.075-1.065-6.059-2.396-8.907-3.977 c-1.529-0.851-3.395-0.838-4.914,0.033c-1.52,0.871-2.473,2.473-2.513,4.224c-0.007,0.295-0.007,0.59-0.007,0.889 c0,23.935,12.882,45.484,32.577,57.229c-1.692-0.169-3.383-0.414-5.063-0.735c-1.732-0.331-3.513,0.276-4.681,1.597 c-1.17,1.32-1.557,3.16-1.018,4.84c7.29,22.76,26.059,39.501,48.749,44.605c-18.819,11.787-40.34,17.961-62.932,17.961 c-4.714,0-9.455-0.277-14.095-0.826c-2.305-0.274-4.509,1.087-5.294,3.279c-0.785,2.193,0.047,4.638,2.008,5.895 c29.023,18.609,62.582,28.445,97.047,28.445c67.754,0,110.139-31.95,133.764-58.753c29.46-33.421,46.356-77.658,46.356-121.367 c0-1.826-0.028-3.67-0.084-5.508c11.623-8.757,21.63-19.355,29.773-31.536c1.237-1.85,1.103-4.295-0.33-5.998 C307.394,57.037,305.009,56.486,302.973,57.388z"/> </svg> </a></div><div class="icon"> <a title="Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio" href="https://stackoverflow.com/questions/tagged/istio"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 120"><polygon points="84.4,93.8 84.4,70.6 92.1,70.6 92.1,101.5 22.6,101.5 22.6,70.6 30.3,70.6 30.3,93.8 "/><path d="M38.8,68.4l37.8,7.9l1.6-7.6l-37.8-7.9L38.8,68.4z M43.8,50.4l35,16.3l3.2-7l-35-16.4L43.8,50.4z M53.5,33.2 l29.7,24.7l4.9-5.9L58.4,27.3L53.5,33.2z M72.7,14.9l-6.2,4.6l23,31l6.2-4.6L72.7,14.9z M38,86h38.6v-7.7H38V86z"/> </svg> </a></div></div><div class="row justify-content-start d-none d-lg-flex"><p class="tag">for users</p></div></div></div><div class="col-6 col-lg-4"><p class="text-center copyright" role="contentinfo"> Istio Archive 0.7, Copyright © 2018 Istio Authors<br> Archived on 05-May-2018</p></div><div class="col-6 col-lg-4 d-none d-lg-flex" role="navigation"><div class="container-fluid"><div class="row justify-content-end"><div class="icon"> <a title="Join the istio-dev@ mailing list to discuss development issues around the Istio project" href="https://groups.google.com/forum/#!forum/istio-dev"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 490 490"><path d="M480,410.248H10c-5.523,0-10-4.477-10-10V89.752c0-5.523,4.477-10,10-10h470c5.522,0,10,4.477,10,10v310.495 C490,405.771,485.522,410.248,480,410.248z M20,390.248h450V99.752H20V390.248z"/><path d="M245,286.131c-2.083,0-4.167-0.649-5.931-1.948L48.64,143.929c-4.446-3.275-5.396-9.535-2.121-13.982 c3.275-4.447,9.535-5.396,13.982-2.121L245,263.712l184.5-135.886c4.447-3.274,10.709-2.326,13.982,2.121 c3.275,4.447,2.325,10.707-2.121,13.982L250.931,284.183C249.167,285.482,247.083,286.131,245,286.131z"/> </svg> </a></div><div class="icon"> <a title="GitHub is where development takes place on Istio code" href="https://github.com/istio/community"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 478.165 478.165"><path d="M349.22,55.768c6.136,14.046,10.241,37.556,4.224,54.69 c24.426,20.999,33.073,71.904,21.079,113.704c35.006,2.73,76.666-1.235,103.642,9.484c-25.183-3.248-59.651-9.563-91.987-7.431 c-6.136,0.458-15.361-0.239-14.903,8.408c37.735,3.008,75.092,6.117,105.894,15.779c-30.702-4.981-67.74-12.552-105.894-13.668 c-15.54,30.921-47.239,46.262-90.991,49.49c4.682,10.261,13.847,14.066,15.879,30.702c3.267,24.406-4.881,60.328,3.208,76.686 c4.064,7.89,10.579,8.009,14.863,14.604c-10.699,12.871-37.257-1.395-40.186-14.604c-5.14-22.852,7.89-58.256-6.415-73.737 c0.996,24.865-5.718,59.85,0.996,82.145c2.789,8.806,10.659,12.113,8.647,20.063c-49.809,5.08-28.989-64.373-37.177-105.356 c-7.471,0.697-4.204,11.197-4.224,15.76c-0.199,40.106,8.189,94.836-34.846,89.556c-1.315-8.348,5.838-11.217,8.467-19.007 c7.91-22.434-1.454-56.045,2.112-83.161c-16.417,12.512,1.793,55.666-8.428,77.961c-5.838,12.671-24.785,18.27-39.19,12.651 c1.873-9.464,11.695-7.989,15.879-16.875c5.818-12.452,0.02-30.244,2.092-48.494c-30.423,6.097-53.993-0.877-65.608-20.023 c-5.12-8.507-6.356-18.708-12.632-26.219c-6.117-7.551-16.098-8.507-19.087-18.808c37.755-9.185,39.17,38.771,73.06,39.807 c10.44,0.418,15.799-2.909,25.402-5.16c2.749-12.113,8.428-21.039,16.875-27.494c-42.078-5.658-76.865-18.788-93.023-50.466 c-38.293,1.893-73.339,7.013-105.894,14.843c29.547-10.679,65.807-14.604,104.778-15.819c-2.351-13.807-22.434-10.022-34.866-9.543 C47.677,227.17,18.449,230.138,0,233.645c26.817-9.543,64.233-8.348,100.454-8.428c-11.038-34.767-7.232-90.014,17.015-110.615 c-6.854-17.254-4.722-45.346,4.184-58.834c27.036,1.175,43.374,12.891,60.388,24.247c21.019-6.017,43.035-9.045,71.904-7.451 c12.133,0.677,24.705,6.097,33.731,5.32c8.906-0.877,18.728-10.898,27.534-14.843C326.507,58.099,336.17,56.206,349.22,55.768z"/> </svg> </a></div><div class="icon"> <a title="Access our team drive if you'd like to take a look at the Istio technical design documents" href="https://groups.google.com/forum/#!forum/istio-team-drive-access"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 207.027 207.027"><path d="M69.866,15.557L0,138.919l28.732,52.552l143.288-0.029l35.008-59.588L136.39,15.735L69.866,15.557z M17.166,139.046 L74.268,38.205L91.21,67.783L33.24,168.447L17.166,139.046z M99.841,82.851l23.805,41.558l-47.732-0.006L99.841,82.851z M163.434,176.443l-117.332,0.024l21.53-37.065l64.606,0.008l0.067,0.119l52.865-0.085L163.434,176.443z M140.932,124.411 L90.157,35.767l-2.966-5.178l40.751,0.121l57.003,93.706L140.932,124.411z"/> </svg> </a></div><div class="icon"> <a title="If you'd like to contribute to the Istio project, consider participating in our working groups" href="https://github.com/istio/community/blob/master/WORKING-GROUPS.md"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -45 439.833 439.833"><polygon points="246.048,195.833 299.966,235.085 319.497,227.296 276.278,195.833"/><polygon points="193.786,195.833 163.556,195.833 120.33,227.3 139.862,235.089"/><path d="M219.927,11.558c-23.854,0-37.057,12.362-36.814,36.182c0.348,32.623,14.211,52.414,36.814,52.068 c0,0,36.802,1.492,36.802-52.068C256.729,23.918,244.294,11.558,219.927,11.558z"/><path d="M285.017,124.567l-36.77-14.659l-8.608-7.256c-2.274-1.922-5.636-1.78-7.741,0.317l-11.973,11.904l-12.008-11.907 c-2.109-2.094-5.465-2.229-7.736-0.313l-8.611,7.256l-36.77,14.661c-11.842,4.715-11.83,46.647-12.848,50.497h155.93 C296.866,171.228,296.862,129.28,285.017,124.567z"/><path d="M77.976,228.568c0,0,36.801,1.492,36.801-52.068c0-23.82-12.434-36.182-36.801-36.182 c-23.854,0-37.057,12.362-36.814,36.182C41.509,209.124,55.372,228.915,77.976,228.568z"/><path d="M143.065,253.329l-36.77-14.658l-8.609-7.256c-2.275-1.923-5.635-1.781-7.742,0.315l-11.971,11.904l-12.008-11.908 c-2.109-2.094-5.465-2.229-7.736-0.312l-8.611,7.256l-36.77,14.66C1.006,258.045,1.018,299.977,0,303.827h155.93 C154.915,299.988,154.911,258.042,143.065,253.329z"/><path d="M361.878,228.568c0,0,36.801,1.492,36.801-52.068c0-23.82-12.434-36.182-36.801-36.182 c-23.854,0-37.057,12.362-36.812,36.182C325.411,209.124,339.274,228.915,361.878,228.568z"/><path d="M426.968,253.329l-36.77-14.658l-8.609-7.256c-2.273-1.923-5.635-1.781-7.742,0.315l-11.971,11.904l-12.008-11.908 c-2.109-2.094-5.465-2.229-7.736-0.312l-8.61,7.256l-36.771,14.66c-11.842,4.715-11.83,46.646-12.848,50.497h155.93 C438.817,299.988,438.812,258.042,426.968,253.329z"/> </svg> </a></div><div class="icon"> <a title="Interactively discuss development issues with the Istio community on Slack (invitation-only)" href="https://istio.slack.com"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 31.444 31.443"><path d="M31.202,16.369c-0.62-1.388-2.249-2.011-3.637-1.391l-1.325,0.594l-3.396-7.591l1.325-0.592 c1.388-0.622,2.01-2.25,1.389-3.637c-0.62-1.389-2.248-2.012-3.637-1.39l-1.324,0.593l-0.593-1.326 c-0.621-1.388-2.249-2.009-3.637-1.388c-1.388,0.62-2.009,2.247-1.389,3.637l0.593,1.325L7.98,8.598L7.388,7.273 c-0.621-1.39-2.249-2.009-3.637-1.39C2.363,6.504,1.742,8.132,2.362,9.52l0.592,1.324L1.63,11.438 c-1.388,0.621-2.01,2.247-1.389,3.636c0.62,1.388,2.249,2.01,3.637,1.39l1.325-0.594l3.394,7.592l-1.325,0.592 c-1.388,0.621-2.009,2.25-1.389,3.637c0.621,1.389,2.249,2.011,3.637,1.391l1.324-0.593l0.593,1.325 c0.621,1.389,2.249,2.01,3.637,1.389c1.387-0.62,2.009-2.248,1.388-3.636l-0.591-1.326l7.591-3.394l0.592,1.321 c0.621,1.391,2.248,2.013,3.637,1.392c1.388-0.619,2.01-2.248,1.389-3.637l-0.592-1.324l1.323-0.594 C31.201,19.384,31.823,17.757,31.202,16.369z M13.623,21.215l-3.395-7.593l7.591-3.394l3.395,7.591L13.623,21.215z"/> </svg> </a></div></div><div class="row justify-content-end text-right"><p class="text-right tag">for developers</p></div></div></div></div></div></footer></div><script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js" integrity="sha384-JZR6Spejh4U02d8jOt6vLEHfe/JQGiRRSQQxSfFWpi1MquVdAyjUar5+76PVCmYl" crossorigin="anonymous"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/clipboard.min.js"></script> <script src="https://www.google.com/cse/brand?form=search_form"></script> <script src="/v0.7/js/misc.min.js"></script></body></html>
|