►
From YouTube: Getting Started with Kong's Istio Ingress Gateway
Description
In this demo from Kong Summit, @ViktorGamov used Istio service mesh and Kong Istio Gateway (Kong Gateway + Kong' Ingress Controller) to provide external access to the services that run inside service mesh enabled Kubernetes cluster. Learn more about Kong Istio Gateway: https://konghq.com/solutions/istio-gateway
▬▬▬▬▬▬ TIMECODES ▬▬▬▬▬▬
0:00 - Intro
0:55 - Download and Configure Istio
1:54 - Create a Namespace for Kubernetes Ingress Controller
2:17 - Deploy Kong Istio Gateway With Helm and Test with Insomnia
4:13 - Deploy BookInfo Example Application
5:08 - Access the Demo App Externally Through Kong Gateway
5:47 - Add Observability Tools
7:16 - Simulate Normal User Behavior
8:37 - Protect Your Services with the Rate Limiting Plugin
▬▬▬▬▬▬ LINKS ▬▬▬▬▬▬
❏ Full blog tutorial: https://konghq.com/blog/istio-gateway/
❏ Automated demo scripts on GitHub: https://github.com/Kong/demo-scene/tree/main/gateway4mesh/istio
❏ Running the Kubernetes Ingress Controller with Istio
Documentation: https://docs.konghq.com/kubernetes-ingress-controller/2.0.x/guides/getting-started-istio/
❏ Kong Summit presentation from our CTO and Co-Founder, Marco Palladino: https://konghq.com/videos/opening-keynote-part-2-the-kong-journey/
❏ Watch more recordings from Kong Summit here: https://konghq.com/kong-summit/2021-videos
▬▬▬▬▬▬ CONTACTS ▬▬▬▬▬▬
🐦 https://gamov.dev/twitter
📧 https://gamov.dev/telegram
🔴 https://gamov.dev/youtube
▬▬▬▬▬▬ COMMUNITY ▬▬▬▬▬▬
⭐ https://github.com/Kong/kong
🐦 https://twitter.com/thekonginc
🌎 https://konghq.com/community/
🍻 https://www.meetup.com/pro/kong
❓ ️https://discuss.konghq.com/
💯 https://konghq.com/kong-champions/
#Istio #ServiceMesh #APIGateway #KongGateway #KongSummit
A
Have
you
ever
found
yourself
in
a
situation
where
all
your
services
are
running
in
kubernetes
and
now
you
need
to
expose
them
to
outside
world
securely
and
reliably.
Ingress
management
is
essential
part
of
your
configuration
and
operations
when
services
are
exposed
outside
of
a
cluster
and
one
needs
to
take
care
of
the
application
observability
of
auditing
encryption
integration
with
other
third-party
vendors.
A
Alongside
of
other
things,
in
this
demo,
we
will
be
using
istio
as
our
service
mesh
and
we
will
be
using
clonk
gateway
and
clonk
ingress
controller
in
order
to
provide
external
access
to
the
services
that
run
inside
service
mesh
enable
kubernetes
cluster.
Let's
briefly
start
by
explaining
this
kubernetes
cluster,
for
this
particular
demo,
we're
using
mini
cube,
which
is
going
to
be
a
local
installation.
Details
of
this
demo
will
be
applicable
to
any
kubernetes
installation.
Mini
cubes
was
taken
as
an
example
to
run
this
locally.
A
The
first
thing
that
we
need
to
do
is
to
install
and
download
archive
that
includes
some
of
the
tools
that
istio
provides
specifically
we're
downloading
istio
control
tool.
We
need
to
enable
this
tool
by
putting
this
into
the
folder
that
will
be
somewhere
in
your
path,
so
it
will
be
available
and
we're
gonna
run
this
small
tool
called
precheck.
That
checks
is
our
cluster
able
and
willing
to
run
our
service
mesh,
so
istio
control
precheck
runs
successfully
and
smoothly.
We're
ready
to
do
service
mesh.
A
So
next
thing
is
that
we're
gonna
install
a
control
plane
of
istio
with
minimal
configuration
that
will
just
deploy
one
port
that
will
include
istio
pilot.
That's
only
thing
that
we're
gonna
be
needing
for
this
application.
Even
though
istio
comes
with
some
other
tools,
we
just
need
to
have
istio
pilot,
and
if
we
can
see
this
in
my
k9s
application,
our
istio
pilot
is
up
and
running,
and
our
control
plane
is
ready
to
do
some
interesting
things.
A
So
next
thing
is
that
we're
going
to
deploy
conch
and
we're
going
to
deploy
this
in
an
environment
where
istio
will
be
able
to
inject
some
of
the
data
plane,
so
we're
creating
a
istio
constituent
space
and
we
providing
label
to
this
namespace
that
enables
istio
injection
so
next
thing
that
we
observe
this
label
that
it
was
successfully
applied.
Let's
go
ahead
and
deploy
quang
next
to
deploy,
quank
we're
going
to
be
using
help
and
we
deploy
this
using
officially
provided
help
charts.
A
I
need
to
add
this
helm
charger
repo
to
my
local
repo
and
after
that
update
information
by
running
helm,
repo
update
in
the
next
step,
we're
going
to
be
installing
help
chart
with
name
of
release,
calling
easter
we're
going
to
deploy
this
in
nam
space
called
kong,
istio
and
quan
clonk.
It's
our
helm
chart
that
we're
going
to
be
installing,
as
we
can
see
here,
there's
a
multiple
containers
in
one
port,
two
of
those
come
with
clonk
ingress
controller
and
calling
itself.
A
So
we
can
see
that
there's
ingress
controller
and
proxy
and
istio
also
injected
two
data
plane
containers.
One
is
init
container
that
was
set
initial
rules
for
ip
tables
to
route.
All
the
traffic
that
goes
into
this
port
into
the
this
istio
proxy
and
istio
proxy
will
be
capturing
some
of
the
traffic
that
goes
into
this
container.
A
As
the
next
step,
we
need
to
figure
out
the
external
ip
address
of
our
clonk
ingress
in
the
real
world
applications
you
can
use
the
load
balancer
to
expose
calling
to
outside
world
for
mini
cube,
we're
gonna,
run
a
command
called
mini,
cube
service
list
that
allows
to
get
address
and
port
of
this
cloning
service
you're
going
to
be
using
some
sort
of
nat
magic
in
order
to
expose
it.
Let's
try
to
test
this
using
insomnia,
we're
going
to
create
a
simple
request
to
this
service.
A
And
voila,
we
can
see
traditional
greetings
from
the
quank,
where
nothing
is
configured,
there's
no
route
matching
with
those
values,
meaning
that
there's
nothing
is
configured
there.
Let's
observe
our
headers
and
see
what
we
see
in
there,
traditional
clonk
headers
and
some
of
the
headers
that
come
from
envoy,
which
is
our
data
plane
that
istio
injected
we're
using
this
information
for
tracing
some
of
the
requests.
We're
going
to
be
absorbing
this
in
future.
A
A
There's
a
label
istio
injection
enabled
next
we're
gonna
do
cook
control
apply
file
that
will
include
manifest
for
this
book
info
that
will
include
multiple
different
components,
including
deployment
services,
three
different
components
that
would
include
the
front-end
application,
some
of
the
details
of
the
book
and
a
ratings
information
service.
We
deploy
three
different
versions
of
review
service
that
we're
going
to
be
using
in
the
future.
A
To
show
how
we
can
randomize
the
traffic
and
heat
different
versions
of
review
service,
we
need
to
wait
until
a
product
page
will
be
up
and
running
because
that's
our
front
end-
and
this
is
the
place
where
we're
gonna
start
our
ui
once
we're
done,
we
need
to
expose
the
product
service
using
kubernetes
ingress.
Let's
quickly
take
a
look
how
our
ingress
file
looked
like
in
this
here.
We
seen
that
our
ingress
class
mentioned
conch
and
in
this
case,
quank
ingress
controller
will
handle
this
and
the
traffic
will
be
routed
to
product
page
service.
A
Let's
go
ahead
and
apply
this
ingress
and
we
will
be
able
to
hit
the
service
in
our
insomnia
tool,
so
successful
response
and
voila.
We
see
this
ui
here
as
well.
Let's
open
this
in
the
browser
and
click
around
different
versions.
So
let's
see
how
the
normal
user
sees
this.
Let's
see
how
the
test
user
sees
this
so
so
far
and
so
good
in
order
to
review
internal
beauty
of
this
application,
we're
going
to
install
some
of
the
reservability
tools
that
istio
comes
with
so
we're
going
to
install
a
prometheus
in
order
to
capture
metrics.
A
We're
going
to
install
jagger
in
order
to
capture
all
the
traces
that
services
might
have
and
we're
going
to
use
kiali
is
our
ui
tool
to
observe
what
is
going
on
with
our
services.
We
need
to
wait
a
few
seconds
until
kiali
service
will
be
up
and
running,
because
this
is
our
place.
We're
gonna
be
starting.
We
need
to
expose
the
port
where
the
cal
is
deployed,
so
we
can
go
with
the
browser
and
see
there
we're
interested
in
a
book
info
namespace.
A
A
So
let's
do
this
so
we're
gonna
be
opening
this
in
our
browser
and,
let's
click
around
again,
so
we
go
in
the
one
page
of
normal
user
and,
as
you
can
see
here,
this
browser
is
actually
going
to
this
application
through
ingress,
so
we're
hitting
quank
ingress
here
and
now
as
a
test
user.
We're
doing
the
same.
So
if
we
refresh
the
screen,
we
immediately
start
seeing
all
trace
all
the
things
that
how
going
on
in
our
application,
we
see
that
request
comes
from
browser.
A
It
goes
into
proxy
and
after
that
it
goes
in
our
services,
a
product
page,
there's
a
front
end.
There's
reviews
some
book
details
and
so
far
and
so
on.
Let's
have
some
fun
with
this
deployment
and
deploy
some
additional
destination
rules.
So
in
this
particular
case
we
want
to
see
that
random
load
balancer
that
every
time
when
will
be
heating
our
review
service,
based
on
the
request,
it
will
be
routing
us
to
different
version
of
the
service
just
for
fun,
just
to
see
how
it
works
and
how
we
can
observe
this.
A
Let's
apply
this
group
control
apply
file
next
we're
gonna
using
a
functionality
of
insomnia
that
allows
to
repeat
certain
requests
on
particular
interval,
so
we're
gonna
hitting
this
page
with
the
two
seconds
interval.
So
we
can
simulate
user
behavior
like
someone
is
hitting
this
page
same
way.
We
can
actually
go
to
different
pages
and
pretend
that
it's
gonna
be
normal.
User
is
clicking
around
here
with
two
seconds
interval.
A
We
can
get
back
to
kiali
ui
and
see
what
do
we
have
here,
as
you
can
see
here
now,
every
time
when
hitting
your
views,
we
go
into
the
different
version
of
this
review
service.
Some
of
the
service
depend
on
the
rating
application.
Some
of
the
services
are
not
so
that's
why
we
might
see
some
of
the
ratings,
and
sometimes
we
cannot
see
some
ratings.
So
with
these
traffic
policies,
we
can
have
a
very
flexible
routing
to
our
application.
A
So
next
thing
is
that
we
enable
some
of
the
cloning
plugins
in
this
deployment
and
see
how
we
can
get
the
leverage
of
this
we're
going
to
be
deploying
this
rate
limiting
plugin
that
will
have
a
30
request
per
minute.
Next,
we're
going
to
do
coup
control,
apply
plugin
in
an
order
create
of
this
object.
Plugin,
and
the
next
step
will
be
enabling
this
plugin
for
ingress.
A
After
we
apply
this
plugin,
we
need
to
modify
our
ingress
in
order
to
enable
this
plugin,
for
particular
ingress
in
this
case,
we're
adding
annotation
called
conhq.com
plugins,
and
we
enable
this
plugin
here
we
do
have
some
extra
headers
for
our
rate,
limiting.
We
know
when
it
will
expire,
how
many
requests
we
have
left
and
when
the
next
time
will
we
have
an
opportunity
to
submit
new
requests.
So
we
have
it
here.
We
submit
this
every
one.
A
Second,
in
order
to
get
the
result
quicker
and
after
a
certain
time
we
start
seeing
some
of
the
errors
very
quickly.
We
see
the
api
rate
limit
exceeded,
meaning
that's
just
too
many
requests
that
happen
here
and
kiali
will
be
able
to
capture
this
429
error
in
the
ui,
and
we
will
be
able
to
observe
this
in
the
ui
really
quickly
because
of
the
con
is
pushing
back.
So
we
will
see
this
red
line.
That
happened
when
the
browser
hits
the
clone,
and
we
see
these
errors
here,
because
we
cannot
access
this
product.