►
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Deploy Istio for Production Workshop- Ramratan Vennam, Solo.io (Part 1)
In this workshop, we dive into Istio foundations with a focus on rolling it out to your organization. Istio is powerful, but learning how to deploy it, configure it, debug it, and secure it has many challenges. Some of the topics that we will cover in this workshop include:
Installing production ready Istio
- Establish security and configuration boundaries
- Expanding the mesh to your organization
- Connecting to observability systems
- Debugging tools when things aren't working as expected
The instructor is a Field Engineer and an Istio veteran who helps companies learn, deploy, run and debug Istio on a daily basis. Over the last 3 years, he has gained beneficial knowledge and several best practices that will be shared in this hands-on workshop.
A
Everyone
welcome
to
our
workshop.
This
is
the
almost
like
a
part,
two
of
the
previous
workshop
that
linden
lin's
workshop
was
more
on
how
to
install
sdo
and
how
to
use
istio,
whereas
this
one
is
going
to
slightly
to
take
a
different
angle
and
and
focus
more
on,
like
the
sre
role
of
how
to
deploy
istio
for
production,
how
to
use
production
components,
not
just
the
stuff
that
comes
out
of
the
box
as
samples
and
then
some
debugging
tools,
so
that
as
an
sre
or
like
in
your
production
environment.
A
When
something
goes
wrong,
how
can
you
debug
exactly
what's
happening
without
knowing
too
much
about
the
application
itself,
but
just
being
able
to
introspect
the
network?
You,
I
think
everyone
here
has
been
in
the
previous
lab.
If
you
haven't,
you
know,
go
to
play.instruct.com
and
make
an
account
and
then
a
little
bit
about
me.
I'm
also
a
field
engineer
at
solo.
A
A
I
think
you've
heard
a
pitch
about
solo
a
couple
of
times
already,
so
I'm
going
to
skip
over
that
the
two
main
products
that
we
have
are
glue
mesh,
which
is
our
enterprise,
istio
and
then
glue
edge,
which
is
our
enterprise
envoy
that
sits
at
the
edge
and
then
with
glue
mesh.
We
also
have
a
gateway
solution
that
brings
in
all
of
the
api
gateway
functionality
to
the
istio
ingress
gateway.
A
We
have
various
other
sessions
in
the
day.
I
think
we're
like
halfway
through
the
day,
so
the
the
other
session
that
we
have
is
multi-cluster
service
mesh
later
on
in
the
day
at
3,
30
p.m,
that
another
field
engineer
from
solo
will
be
running
and
it'll
be
in
here
I'll
be
moderating
in
here
like
like.
I
did
this
morning.
A
A
So
once
you
once
you
click
this
link,
you'll
see
the
track.
You
basically
add
it
to
your
study
room
and
then
you
start
it
and
then
once
you
start
it,
it
sets
up
the
environment.
It
sets
up
your
kubernetes
cluster,
so
that
process
takes
about
a
couple
minutes.
So
while
that's
running
I'm
going
to
kind
of
move
forward.
A
All
it's
doing
is
it's
converting
your
simple
istu
api
to
thousands
of
lines
of
envoy
configuration
and
then
pushing
it
to
all
the
various
pods,
and
then
it
can
scope
it
down.
It
can
export
it
to
the
right
name,
spaces
et
cetera.
So
it
knows
what
pods
need
to
talk
to
what
pods.
So
it's
able
to
program
each
envoy
intelligently,
it's
a
control
plane.
So
let's
do
that.
A
A
A
A
So
once
that's
done,
give
it
a
couple
of
seconds
and
then
the
next
command
will
exec
into
the
sleep
container
and
then
call
your
http
bin
container
and
it's
going
to
call
slash
headers.
So
then,
http
bin
will
respond
back,
basically,
whatever
headers
that
you
passed
it
and
anything
else
that
it
adds.
So
you
know
pretty
straightforward,
there's
really
nothing
there.
It's
saying
that
you
called
me
from
carl.
This
is
the
host
that
you
called
me
on
and
nothing
else.
A
So
next,
let's
deploy
envoy
envoy,
reads
its
configuration
from
multiple
ways.
You
can
statically
declare
it
using
this
envoy,
conf
yaml
that
we're
going
to
show-
or
you
can
also
program
it
dynamically
using
its
xds
api.
But
for
now,
let's
just
look
at
you
know
a
static
definition,
so
this
is
so.
If
I
open
up,
if
I
do
a
cat
on
envoy
comp.yaml
that
already
exists
in
this
in
this
environment,
we
can
see
some
admin
configuration
it's
showing
that
you
know.
A
You
know
where
to
save
the
access
log,
what
port
the
admin
port
is
listening
on
and
then
the
static
resources
is
the
config
is
all
the
config
that
you
need
to
tell
envoy.
If
you
receive
traffic
on
this
port,
I
want
you
to
to
direct.
You
know,
do
whatever
envoy
things
you
have
to
do
and
then
direct
traffic
to
your
the
http
bin
app.
So
what
we're
trying
to
do
is
use
envoy
as
a
proxy.
A
So
this
is
just
saying
that
I
want
to
create
an
http
filter
and
then
this
is
my
route
config
over
here.
I
want
to
listen
on
all
domains,
all
prefix
for
for
your
route
matching
and
then
I
want
to
send
it
to
this
http
bin
service,
cluster,
cluster
and
envoy
terminology
is
basically
like
a
set
of
endpoints.
These
are
your
destinations
that
that
envoy
will
direct
traffic
to
and
then
that
clusters
is
defined
on
the
bottom.
So
it's
going
to
define
that
http
bin
service
that
you
see
up
here
down
here.
A
Okay,
so
that's
my
very
simple
envoy
config!
That's
about
you
know
as
simple
as
it
gets
so
then,
let's
create
a
config
map.
Out
of
that
configuration
apply
that
config
map
to
my
kubernetes
cluster
and
then
deploy
envoy
proxy.
So
it's
going
to
be
another
pod,
another
container.
So
now
you
have
three
containers:
http
bin
sleep
and
envoy.
A
When
you
ran
your
exact
command
before
we
exact
and
to
sleep
and
went
directly
to
http
bin,
but
now
we're
going
to
exec
into
sleep,
but
instead
of
going
to
http
bin
we're
going
to
call
envoy
and
then
we're
going
to
do
slash
headers
but
we've
configured
envoy
to
direct
all
traffic
to
http
bin.
So
let's
do
that.
A
A
A
A
Http
bin
app
has
an
end
point
where
you
can
tell
it
to
have
a
delay
before
responding.
So
if
you
go
to
slash
delay
five,
then
it's
going
to
wait
five
seconds
before
responding
well
we've
configured
envoy
to
timeout
after
one
second,
so,
as
you
would
expect,
the
connection
should
fail.
So
you
can
see
now
we
have
a
h504
gateway,
timeout.
A
When
things
are
not
working
well,
envoy
exposes
the
stats
endpoint
as
well
as
other
endpoints
that
we'll
get
to,
but
for
now
we're
going
to
look
at
the
stats
endpoint
where
you
can
get
statistics
about.
You
know
what
what's
going
on
in
the
what's
going
on
with
all
the
requests,
so,
let's
exec
again
from
sleep,
but
now
we're
going
to
call
envoy's
admin,
port
admin,
port
that
15
000
and
then
slash
stats.
A
A
A
A
A
A
Give
it
a
couple
of
seconds
and
that
http
bin
app
also
has
a
slash
status,
slash,
500
and
point
if
you,
if
you
call
slash
status,
500
it's
going
to
reply
back
with
the
500.
If
you
call
502
it
replies
back,
so
it's
just
like
a
basically
like
an
echo,
so
you
can
do
various
tests.
So
if
you
do
the
slash
500,
it
comes
back
with
a
500.
A
Okay,
that's
that's!
As
expected,
you
can
see
http
101
500
internal
server
error,
but
we
want
to
see
more
details
about
about
this
500
right.
So
let's
use
the
stats
endpoint
with
the
grep
for
retry
and
see
what's
going
on
so
now
we
see
if
you
look
closely
that
this
cluster
http
bin
service
has
a
retry
label
with
the
value
set
to
three.
That
means
that
envoy
tried
to
hit
this
endpoint
three
times
and
it
failed
so
good
stuff.
There
that's
very
useful.
A
If
everything
is
working
well
and
you
periodically
check
the
stats
endpoint
and
you
see
various
retries,
that
might
be
a
sign
for
you
to
figure
out
like
hey,
what's
going
on,
why
am
I
getting
retries
once
in
a
while?
It's
good
that
istio
is
able
to
mask
this
by
applying
this
retry
policies,
but
you
still
want
to
kind
of
know
that
this
is
happening
once
in
a
while.
A
The
next
the
next
lab
we're
actually
going
to
install
sto
we're
going
to
install
istio
using
revisions
revisions.
Let
you
specify
a
version
of
istio
to
deploy
into
your
cluster
that
helps
you
when
you
want
to
do
upgrades
so
that
you
can
have
istio
183
installed
into
your
cluster
and
then
you
can
have
istio
195
also
installed
in
the
same
cluster,
and
you
can
tell
your
pods,
you
know
which
istio
do
you
want
to
use
and
you
can
do
slowly
incremental
upgrades.
A
So
for
that
reason,
revisions
are
extremely
important,
especially
in
production
where
you
don't
want
to
impact
any
traffic,
and
you
want
to
do
gradual
rollouts
of
any
changes.
So
we
have
the
namespaces
at
the
top
are
default
istio
and
system,
sorry
default
istio
and
action
namespace,
as
well
as
the
istio
system
namespace
in
the
default
namespace.
A
We
have
the
http
bin
app.
That
should
already
be
there
we're
going
to
create
this
new
namespace
stone
action
and
deploy
this
the
same
app.
You
ran
in
the
previous
lab.
It's
got,
four
microservices
web
recommend
purchase
and
sleep
and
then
in
the
istio
system
namespace.
This
is
where
we're
going
to
deploy
our
istio
question.
A
Yes,
the
number
one
recommended
way
of
installing
istio
is
to
use
istio
cuddle,
so
istio
cuttle
manifest
apply
or
you
know,
manifest,
generate
look
at
the
ammo
and
apply,
I
would
say
the
the
second
best
approach.
If
you're
installing
brand
new
istios
moving
forward,
the
helm
support
is
getting
better
and
better
right.
Now
it's
it's
an
alpha,
but
I
believe
in
the
next
version,
where
the
alpha
label
is
going
to
go
away
and
helm,
3
will
be
will
be
supported
and
then
the
istio
operator
it
it
works.
A
Like
last
year,
you
know:
istio
came
with
like
multiple
components,
but
now
you
know
istio
is
kind
of
shrinking
down
into
just
the
single
monolithic
sdod
and
then
the
gateway
portion
of
istio
is
becoming
more
of
a
user
user's
responsibility
because
they're
installing
the
gateways
into
their
own
namespaces
for
for
better
delineation
of
security,
traffic
and
administrative
domains.
So
for
that
reason,
because
there's
kind
of
only
one
pod
or
like
you
know,
one
deployment
is
dod.
A
Normally,
when
you
run
this
istio
cuddle
version
and
it's
and
you
your
cube,
config
is
pointed
at
a
cluster
that
has
a
steel
installed.
Then
it's
able
to
go
query
that
cluster
to
see
what
version
you
have
installed,
because
we
don't
have
sto
installed.
Yet
that's
why
it
says
no
istio
pods
in
istio
system
system
namespace,
but
then
the
183
on
the
bottom
is
the
version
of
the
cli.
A
A
Great
and
then,
let's
kind
of
proceed,
we're
kind
of
running
short
on
time.
We're
slow
going
a
little
slower
than
I
expected,
but
you
know
we're
going
to
create
the
istio
system.
Namespace
we're
going
to
create
this
istiod
service.
This
is
kind
of
a
workaround
for
a
bug.
That's
been
there
in
istio
for
a
while.
Where,
if
you
want
to
do
is
to
your
revisions
but
you're
starting
on
a
fresh
cluster,
then
you
need
the
sdod
service
created
for
the
gateways
to
communicate
with.
A
So
that's
what's
defined
here
in
this
istio
operator
in
production,
you
should
always
have
an
istio
operator
file,
have
multiple
istio
operator
files,
one
for
your
sdod
and
then
you
know
one
for
each
one
of
the
gateways
you
have
defined
so
take
advantage
of
multiple
istio
operator
files,
save
these
operator
files
in
your
source
control.
And
then,
when
you
install
istio,
you
would
do
istio
cuddle,
install
and
then
point
it
at
that
that
istio
operator
file
and
then
you
would
specify
your
revision
label
being
1-8-3.
A
Many
users
also
do
like
istio
cuto
install,
and
then
you
can
pass
it
every
single
flag
that
you
want
to
overwrite
directly
with
that
with
that
cli.
But
that's
more
error
prone,
so
take
advantage
of
actually
storing
your
config
in
this
istio
operator
resource
with
the
istio
cuddle
method,
you're,
not
applying
the
file
to
your
kubernetes
cluster
you're,
just
passing
it
to
your
cli.
Your
cli
does
all
the
magic
and
installs
it.
A
A
To
make
sure
that
sdod
is
working,
okay,
you
can
exec
into
sdod
itself,
and
then
it
has
this
pilot
discovery
binary
inside
of
it,
and
that
pilot
that
binary
exposes
all
kinds
of
various
sub
commands
that
you
can
use
to
like
figure
out
what
services
that
your
istiod
has
discovered.
So
this
one
is
just
calling
the
the
registry
endpoint,
so
this
is
you're,
basically
asking
istio's
d
service
registry
to
list
all
the
services
that
it
knows
about.
A
A
But
if
you're
trying
to
do
a
more
methodical,
step-by-step
approach
of
injecting
one
part
at
a
time
to
make
sure
things
are
working
properly,
and
you
want
to
take
advantage
of
revisions
to
point
it
at
the
injector
that
is
version
1.8.3,
then
you
can
use
this
method
of
of
specifying
you're
using
istio
cuddle
to
specify
the
your
config
map
that
you
want
to
use.
So
I
want
to
use
the
mesh
config
map
183,
and
you
can
specify
the
injector
that
you
want
to
use.
A
A
A
A
How
much
15.
cool
yup
we'll
be
able
to
get
through
this?
The
observability
lab
focuses
on
not
using
the
sample
observability
add-ons
that
come
with
istio
the
the
prometheus
deployment,
the
kiali
there
that
come
with
istio,
like
you
know,
if
you,
if
you
follow
the
they
used
to
come
with
istio
itself,
but
now
we've
broken
it
apart
in
the
documentation,
there's
a
separate
section
for
observability
and
and
that
lets
you
get
up
to
speed
quickly
by
using
basically
just
shortcuts
to
to
deploy
prometheus
and
apply
the
config
maps
and
everything.
A
But
in
a
more
production
environment
you
might
have
a
full-fledged
prometheus
installed
using
like
the
prometheus
operator
and
then
using
resources
like
pod
monitors
and
service
monitors
to
discrete
metrics.
So
that's
what
we're
going
to
do
here
is
we're
going
to
set
up
a
more
enterprise
prometheus,
we're
going
to
use
the
prometheus
operator,
we're
going
to
use
the
kiali
operator
and
then
making
sure
that
they're
secured
properly
and
they're
configured
properly.
A
A
A
And
then
the
way
the
port
forwarding
works
in
this
instruct
environments
is
that
we
already
have
these
tabs
configured
to
to
to
listen
to
that
port,
that
localhost
9090
port.
So
if
you
click
on
this
prometheus
tab,
you
can
see
that
it
now
loads.
If
you
were
to
click
this
before
doing
a
port
forward,
you
would
have
a
blank
screen.
A
Actually,
one
step
that
I
missed
is
that
there
are
multiple
terminals,
there's
terminal
tab,
one
and
then
terminal
tab.
Two.
We
want
you
to
do
the
the
port
forwarding
in
tab
two,
so
that
you're
not
blocked,
and
you
can
continue
on
with
in
your
tab
one.
So
if
you,
if
you
did
the
port
forward
in
terminal
1,
do
a
control
c
break
out
of
it,
go
to
terminal
2
and
run
the
port
forward
and
then,
if
you
should
still
be
able
to
get
to
this
prometheus
page.
A
A
A
A
A
Sorry
port
forward
to
grafana
again
and
now,
if
you
go
back
to
grafana
and
then
there
should
be
a
refresh
on
the
top
right,
so
I'm
going
to
hit,
read
him
and
hit
that
refresh
just
to
make
sure
it
picks
and
reloads
properly.
And
then,
if
I
now
go
to
home,
you
can
see.
I
have
all
my
istio
dashboards
loaded.
A
A
A
So
we'll
leave
that
port
forwarding
on
terminal
two.
So
let
that
so
you
know
let
that
port
forward
for
grafana
run
in
terminal
2,
but
then
move
over
to
terminal
1
and
then
start
looking
at
the
prometheus
service
monitor
resource.
So
you
can
take
a
look
to
see.
You
know
how
it's
configured
to
to
read
the
control
plane,
metrics.
A
A
A
A
So
grafana
and
prometheus
are
good
for
for
you
to
see
how
every
single
service
is
doing
the
health
of
every
single
service.
You
know
the
number
of
500s
that
they're
getting
their
response
times.
Etcetera
and
kiali,
on
the
other
hand,
is
a
service
craft.
So
it's
good
for
observing
traffic
as
it's
flowing
through
the
system,
so
it
knows
about
all
the
various
services
and
how
they're
connecting
together
and
it
determines
that
based
on
the
prometheus
metrics.