IBM Cloud Kubernetes Service & IBM Cloud Private

This example demonstrates how to use Istio's multicluster feature to join 1 IBM Cloud Private cluster and 1 IBM Cloud Kubernetes Service cluster together, using the multicluster installation instructions.

Set up two clusters

  1. Install One IBM Cloud Private cluster. NOTE: You can configure Pod CIDR ranges and service CIDR ranges by network_cidr and service_cluster_ip_range in cluster/config.yaml for IBM Cloud Private.

    ## Network in IPv4 CIDR format
    ## Kubernetes Settings
  2. Request One IBM Cloud Kubernetes Service cluster. NOTE: By default, when you have provisioned a IBM Cloud Kubernetes Service cluster, the CIDR is as below.

    pod subnet CIDR:
    service subnet CIDR:

Configure pod communication across IBM Cloud Kubernetes Service & IBM Cloud Private

Since these two clusters are in isolated network environments we need to set up VPN connection between them.

  1. Set up strongSwan in IBM Cloud Kubernetes Service cluster:

    1. Set up helm in IBM Cloud Kubernetes Service by following these instructions.

    2. Install strongSwan using helm chart by following these instructions,Example configuration parameters from config.yaml: add
    3. Get the external IP of the vpn-strongswan service:

      $ kubectl get svc vpn-strongswan
  2. Set up strongSwan in IBM Cloud Private:

    1. Complete the strongSwan workarounds for IBM Cloud Private by following these instructions.

    2. Install strongSwan from the catalog in the management console by following these instructions,example configuration parameters:

      Namespace: default
      Operation at startup: start
      Local subnets:,
      Remote gateway: Public IP of IKS vpn-strongswan service that you get earlier
      Remote subnets:,
      Privileged authority for VPN pod: checked
    3. Verify that IBM Cloud Private can connect to IBM Cloud Kubernetes Service by running the following command on the IBM Cloud Kubernetes Service cluster:

      $ export STRONGSWAN_POD=$(kubectl get pod -l app=strongswan,release=vpn -o jsonpath='{ .items[0] }')
      $ kubectl exec $STRONGSWAN_POD -- ipsec status
  3. Confirm pods can communicate by pinging pod IP in IBM Cloud Private from IBM Cloud Kubernetes Service.

    $ ping
    PING ( 56(84) bytes of data.
    64 bytes from icmp_seq=1 ttl=59 time=51.8 ms

Install Istio for multicluster

Follow the multicluster installation steps to install and configure the local Istio control plane and Istio remote on IBM Cloud Private and IBM Cloud Kubernetes Service.

This example uses IBM Cloud Private as the Istio local control plane and IBM Cloud Kubernetes Service as the Istio remote.

Deploy Bookinfo example across clusters by following these instructions

See also

Example multicluster GKE install of Istio.

Example multicluster IBM Cloud Private install of Istio.

Install Istio with multicluster support.

Instructions to download the Istio release.

Instructions to setup a Google Kubernetes Engine cluster for Istio.

Describes the options available when installing Istio using the included Helm chart.