Istio IstioCon 2022, 16 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Dual Stack Cluster Setup

Description

Presented by Josh Tischer at IstioCon 2022.

Dual Stack support is very limited in today’s cloud ecosystem. Learn how to run/test Istio on a Dual Stack cluster in AWS on both Openshift 4.8+ and KubeAdmin. OpenShift 4.7+ is one of the few options that officially supports Dual Stack mode for bare metal clusters and Azure. We are excited to share our experience and empower your team with another option for Dual Stack support.

A

Everybody, my name is josh tischer and I'm a lead devops engineer at aspen mesh, and I want to talk to you today about dual stack networking on istio and aws to get started. We really need to understand some of the prerequisites for dual stack networking. You really need to be aware that dual stack networking really hasn't been enabled until kubernetes 120..

A

In addition, you really need to pay attention to the underlay networking or the physical infrastructure layer of your cluster.

A

That will include you know things like the bare metal uh network cards configurations of the linux operating systems on their on your hosts.

A

The overlay networking refers much more in detail to the virtualized networking or more like the cni layer in the kubernetes network cluster itself, and then, of course, your applications have to respond to ipv6 as well as ipv4, so make sure you upgrade those to dig more into istio and dual stack. Aspen mesh has been working on these features for about a year and we've been working in addition with the community to open source.

A

This work we've chosen openshift as our primary platform for testing and validation, since it is a production-ready cluster, does have infrastructure as code and is readily available to remake clusters on at your whim and make it reproducible.

A

That's what we really love infrastructure's code for in automation, to get started on on openshift on aws, there's a lot of different ways to do that: we're following the ipi or infrastructure, installer provision, infrastructure deployed from their installer and client tools which require aws, cli and some other things. Please take a look at our open source repository.

A

We have moved a lot of these resources for this presentation there, so that you can reproduce these steps yourself, as well as any some some more additional information in the readme.

A

So how we get started on on openshift is uh we're. Gonna follow our scripts in our repository, the openshift cluster script will help us get started, create a brand new cluster and by default that has ipv4 networking for the underlay.

A

And then we've got another script for upgrading the aws infrastructure, which adds ipv6 dual stack: networking capabilities following the aws guide. That's that's been publicly published and linked here in this document.

A

Once you have upgraded your underlay networking, we need to work on upgrading the cni and the network inside of kubernetes to enable dual stack.

A

So we've prepared another script here that follows the openshift documentation on on how that's possible so go. Take a look at that and then, of course, when you're done make sure you clean up your resources so that you don't incur some extra costs that you weren't aware of, because openshift clusters require five or six nodes, make sure that you clean those up so to dig more into the underlay physical networking side of aws.

A

We've of course got vpc layers, load, balancers, subnets, all the way down to the ec2 instances themselves. All of those infrastructure pieces need to be able to respond to ipv4 and 6., something that we have managed to find. As a part of this is the load balancers themselves for aws. Don't fully use ipv6 directly, they do some ipv4 network translation. So you will see that in your curl and in your curl requests, so once you've dealt with your underlay network and your physical layer, we move on to the overlay networking. So you can see here.

A

We've got two sort of samples of what it might look like to upgrade your cni and your kubernetes cluster configuration for dual stack. You can see in openshift it is applying a patch, that's really simple, to the network versus cube admin, which has much more complicated steps as well as probably restarting the cluster openshift. You can do it on the ready on the fly and it will accept and reload the pods as necessary for any of the resources that it needs from here.

A

Once you have your underlay network and your overlay network prepped, you can install aspen mesh. We've got our installation version, 1118 am2, which has our dual stack network features, enabled and on. The right here is a sample overrides file that will help address some of the configuration issues that you might have to get it installed on openshift from here. Once you have aspen mesh installed, you can validate your pod networking our test, dual stack script here, installs a sleep pod and an http bin in a dual stack namespace.

A

Just so you can run some curl commands, maybe some ns lookups to validate that it. It is indeed responding to those network traffic requests appropriately. Taking that a step further, we've created a in that same script. There is a virtual gateway there, an istio ingress gateway that sets up our load balancer so that we can validate public access as well all the way to our http pin pod, and you can see that this is accepting traffic on both ipv6 and four.

A

So creating an ingress gateway in istio on openshift does have some issues that we have found, and it's due to the openshift controller by default, creates a classic aws load. Balancer.

A

Due to this, you can't upgrade a classic load balancer to accept dual stack networking.

A

So what we've got to do is we've got to use an istio override to change the default from classic to a network load balancer, and then you either have to manually upgrade it from there to a dual stack or you can use an api call to do the same and here's a sample script for you to be able to to see what that configuration might look like, and hopefully one day openshift will support both aspen mesh and intel are working on implementing dual stack in istio we've produced an rfc based design and we are currently evaluating what the next steps are and feedback from the community before we can get this merged in.

A

Please go nudge us in the channel. Make sure that you make us aware how much your interest is in this feature and we are very proud and excited to get this released. So, let's all raise up as a community and see what is useful here for everybody.

A

Thank you. So much for your time enjoy your conference.

A