About the managed Istio add-on
Istio on IBM Cloud® Kubernetes Service provides a seamless installation of Istio, automatic updates and lifecycle management of Istio control plane components, and integration with platform logging and monitoring tools.
With one click, you can get all Istio core components up and running. Istio on IBM Cloud Kubernetes Service is offered as a managed add-on so that IBM Cloud automatically keeps all your Istio components up-to-date.
What is Istio?
Istio is an open service mesh platform to connect, secure, control, and observe microservices on cloud platforms such as Kubernetes in IBM Cloud Kubernetes Service.
When you shift monolith applications to a distributed microservice architecture, a set of new challenges arises such as how to control the traffic of your microservices, do dark launches and canary rollouts of your services, handle failures, secure the service communication, observe the services, and enforce consistent access policies across the fleet of services. To address these difficulties, you can leverage a service mesh. A service mesh provides a transparent and language-independent network for connecting, observing, securing, and controlling the connectivity between microservices. Istio provides insights and control over the service mesh by so that you can manage network traffic, load balance across microservices, enforce access policies, verify service identity, and more.
For example, using Istio in your microservice mesh can help you:
- Achieve better visibility into the apps that run in your cluster.
- Deploy canary versions of apps and control the traffic that is sent to them.
- Enable automatic encryption of data that is transferred between microservices.
An Istio service mesh is composed of two main components, a data plane and a control plane.
- Data plane
- The data plane consists of your applications, the sidecars that are injected into your application pods, the gateways, and data plane configuration resources like
ServiceEntries,VirtualServices,Gateways,DestinationRules,EnvoyFilters, and more. You are responsible for configuring your service mesh, updating your sidecars and custom gateways on a patch update, and upgrading the add-on as newer versions are released. - Control plane
- The control plane consists of the Istio operator, the managed Istio Operator, and
Istiodwhich contains Pilot, Mixer telemetry and policy, and Citadel components. For more information about each of these components, see theistioadd-on description. IBM Cloud manages the control plane by providing patch updates, resolving vulnerabilities, and reconciling the managed resources.
What is Istio on IBM Cloud Kubernetes Service?
Istio on IBM Cloud Kubernetes Service is offered as a managed add-on that integrates Istio directly with your Kubernetes cluster.
What does this look like in my cluster?
When you install the Istio add-on, the Istio control and data planes use the network interfaces that your cluster is already connected to. Configuration traffic flows over the private network within your cluster, and does not require you to open any additional ports or IP addresses in your firewall. If you expose your Istio-managed apps with an Istio Gateway, external traffic requests to the apps flow over the public network interface.
How does the update process work?
The Istio version in the managed add-on is tested by IBM Cloud and approved for the use in IBM Cloud Kubernetes Service. Additionally, the Istio add-on simplifies the maintenance of your Istio control plane so you can focus on managing your microservices. IBM Cloud keeps all your Istio components up-to-date by automatically rolling out patch updates to the most recent version of Istio that is supported by IBM Cloud Kubernetes Service. To update your Istio components to the most recent minor version of Istio that is supported by IBM Cloud Kubernetes Service, such as from Istio version 1.6 to 1.7, you can follow the steps in Updating the minor version of the Istio add-on.
Whenever the managed Istio add-on is updated, make sure that you update your istioctl client and the Istio sidecars for your app to match the Istio version
of the add-on. You can check whether the versions of your istioctl client and the Istio add-on control plane match by running istioctl version.
If you need to use the latest version of Istio or customize your Istio installation, you can install the open source version of Istio by following the steps in the Quick Start with IBM Cloud tutorial. However, note that you can't run community Istio concurrently with the managed Istio add-on in your cluster.
What comes with the Istio add-on?
In Kubernetes clusters, you can install the generally available managed Istio add-on, which runs Istio version 1.23.1.
The Istio add-on installs the core components of Istio. For more information about any of the following control plane components, see the Istio documentation.
Envoyproxies inbound and outbound traffic for all services in the mesh. Envoy is deployed as a sidecar container in the same pod as your app container.istiodunifies functionality that Pilot, Galley, Citadel, and the sidecar injector previously performed into a single control plane package.- The
istio-ingressgatewayandistio-egressgatewaycontrol incoming traffic to and outgoing traffic from your Istio-managed apps. - The Istio operator (
addon-istio-operatorin Istio version 1.10 or later, ormanaged-istio-operatorin Istio version 1.9 or earlier) in theibm-operatorsnamespace validates and reconciles any custom Istio operator (IOP) changes that you make.
Limitations
Review the following limitations for the managed Istio add-on.
- When you enable the managed Istio add-on, you can't use
IstioOperator(IOP) resources to customize the Istio control plane installation. Only theIstioOperatorresources that are managed by IBM for the Istio control plane are supported. If you create anIstioOperatorresource for custom gateways in your Istio data plane, you are responsible for managing those resources. - You can't modify any Istio resources that are created for you in the
istio-systemnamespace. If you need to customize the Istio installation, you can edit themanaged-istio-customconfigmap resource. - The following features are not supported in the managed Istio add-on: