This repo contains the minimal configuration to deploy istio in multi-cluster(on different networks) mode using kind.

• docker
• kubectl
• kind
• istioctl

export NUM_CLUSTERS=2
./kind-setup/create-cluster.sh

Both ingress and egress gateway created by istio need to External IP. MetalLB allocates it for them.

cd kind-setup
./install-metallb.sh

The range of IP addresses that kind cluster controls can be obtained with docker network inspect -f '{{$map := index .IPAM.Config 0}}{{index $map "Subnet"}}' kind

Assuming that the output is of above command is 172.18.0.0/16, we have created metallb-configmap-1.yaml and metallb-configmap-2.yaml. This allocates 172.18.255.225-172.18.255.250 and 172.18.255.200-172.18.255.224 ip ranges to cluster1 and cluster2 respectively. If you are creating more than two cluster, create another metallb-configmap.

A multicluster service mesh deployment requires that us to establish trust between all clusters in the mesh. We use a common root to generate intermediate certificates for each cluster

Note: in this script we -label istio namespace as "topology.istio.io/network=network${i}"

cd kind-setup
./install-cacerts.sh

It does the following for each cluster:

• install istiod with configuration in istio-setup/cluster.yaml
• install a gateway dedicated to east-west traffic
• expose all services (*.local) on the east-west gateway
• install remote secret of this cluster in the other cluster to enable k8s api server endpoint discovery

cd istio-setup
./install-istio.yaml

1. Add istio helm repo and update charts

cd istio-chart
helm repo add sedflix https://sedflix.github.io/charts/
helm dependency update

2. Install helm charts

cd istio-chart
./install.sh

Now, we need to configure each istiod to watch other clusters api servers. We create a secret with credentials to allow Istio to access the other (n-1) remote kubernetes api servers.

cd istio-chart/istio-setup
./enable-endpoint-discovery.sh

It does the following:

• create ns sample in all the cluster
• create service helloworld in all the cluster
• deploy v1 and v2 of helloworld alternatively in each cluster

cd testing
./deploy-application.sh

Go inside a pod and try: curl -s "helloworld.sample:5000/hello". The response should be like when run multiple times

while true; do curl -s "helloworld.sample:5000/hello"; done

Hello version: v1, instance: helloworld-v1-776f57d5f6-znwk5
Hello version: v2, instance: helloworld-v2-54df5f84b-qmg8t..
...

• Go inside the proxy pod and use curl localhost:15000/help

• Istio: Install Multi-Primary on different networks
• Istio: Plugin CA Cert
• Kind: MetalLB
• Istio: Verify MultiCluster Installation