Istio ambient mode

https://istio.io/latest/docs/ambient/overview/

Overview

https://istio.io/latest/blog/2024/ambient-reaches-ga/

Fast, Secure, and Simple: Istio’s Ambient Mode Reaches General Availability in v1.24

 

# 앰비언트 모드

-> 사이드카 모드(기존의 사이드카 프록시를 사용하는 방식)와 달리 사이드카 없이 L4, L7 기능에 따라 공유된 프록시를 통해 트래픽을 관리하는 모드

 

https://istio.io/latest/docs/ambient/architecture/control-plane/

 

 

(참고) 기존의 istio proxy 를 사용하는 사이드카 모드

https://istio.io/latest/docs/concepts/security/

 

 

# 사이드카 모드와 앰비언트 모드 비교

https://istio.io/latest/docs/overview/dataplane-modes/

Sidecar or ambient?

 

요점은 L4/L7을 처리하는 컴포넌트를 나누어 불필요하게 낭비되는 리소스를 없애고, 통신 특성에 맞는 공유된 프록시를 통해 istio 의 기능을 구현한다는 것

 

 

# 사전 작업

## GKE

-> istio-system 네임스페이스에 대한 ResourceQuota 생성 필요

 

apiVersion: v1
kind: ResourceQuota
metadata:
  name: gcp-critical-pods
  namespace: istio-system
spec:
  hard:
    pods: 1000
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical

 

 

## cilium

https://istio.io/latest/docs/ambient/install/platform-prerequisites/#cilium

Platform-Specific Prerequisites

 

cilium cni 를 사용하는 경우 아래 옵션을 수정

 

kubectl edit cm -n kube-system cilium-config

cni-exclusive: "true"
-> false 로 수정

kubectl rollout restart ds -n kube-system cilium

 

 

 

# 앰비언트 모드로 istio 배포

## crd 배포

helm install istio-base istio/base -n istio-system --create-namespace

 

## gateway api 배포

kubectl get crd gateways.gateway.networking.k8s.io &> /dev/null || \
  { kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml; }

 

## istiod 배포

helm install istiod istio/istiod --namespace istio-system --set profile=ambient

 

## istio cni 및 ztunnel 배포

helm install istio-cni istio/cni -n istio-system --set profile=ambient

helm install ztunnel istio/ztunnel -n istio-system

 

## ingress gateway 배포

helm install istio-ingress istio/gateway -n istio-ingress --create-namespace

 

(참고) gke 의 경우 istio cni 차트 배포

helm install istio-cni istio/cni -n kube-system --set cni.cniBinDir=/home/kubernetes/bin --set profile=ambient

 

 

# 샘플 애플리케이션(book info) 배포

https://istio.io/latest/docs/ambient/getting-started/deploy-sample-app/

Deploy a sample application

 

## 샘플 앱 배포

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/bookinfo/platform/kube/bookinfo.yaml

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/bookinfo/platform/kube/bookinfo-versions.yaml

 

## 게이트웨이 생성

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/bookinfo/gateway-api/bookinfo-gateway.yaml

kubectl annotate gateway bookinfo-gateway networking.istio.io/service-type=ClusterIP --namespace=default

 

## 접속

kubectl port-forward svc/bookinfo-gateway-istio 8080:80

접속
http://localhost:8080/productpage

 

 

# 샘플 애플리케이션을 메시에 추가

https://istio.io/latest/docs/ambient/getting-started/secure-and-visualize/#add-bookinfo-to-the-mesh

kubectl label namespace default istio.io/dataplane-mode=ambient

 

 

# 트래픽 시각화

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/addons/prometheus.yaml

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.24/samples/addons/kiali.yaml

istioctl dashboard kiali

for i in $(seq 1 100); do curl -sSI -o /dev/null http://localhost:8080/productpage; done