Install Primary-Remote on different networks
Follow this guide to install the Istio control plane on cluster1
(the
primary cluster) and configure
cluster2
(the
remote cluster) to use the control plane in
cluster1
. Cluster cluster1
is on the network1
network, while cluster2
is on the network2
network. This means there is no direct connectivity
between pods across cluster boundaries.Before proceeding, be sure to complete the steps under before you begin6.
In this configuration, cluster cluster1
will observe the API Servers in
both clusters for endpoints. In this way, the control plane will be able to
provide service discovery for workloads in both clusters.
Service workloads across cluster boundaries communicate indirectly, via dedicated gateways for east-west7 traffic. The gateway in each cluster must be reachable from the other cluster.
Services in cluster2
will reach the control plane in cluster1
via the
same east-west gateway.
Set the default network for cluster1
If the istio-system namespace is already created, we need to set the cluster’s network there:
Configure cluster1
as a primary
Create the Istio configuration for cluster1
:
Apply the configuration to cluster1
:
Install the east-west gateway in cluster1
Install a gateway in cluster1
that is dedicated to east-west traffic. By
default, this gateway will be public on the Internet. Production systems may
require additional access restrictions (e.g. via firewall rules) to prevent
external attacks. Check with your cloud vendor to see what options are
available.
Wait for the east-west gateway to be assigned an external IP address:
Expose the control plane in cluster1
Before we can install on cluster2
, we need to first expose the control plane in
cluster1
so that services in cluster2
will be able to access service discovery:
Expose services in cluster1
Since the clusters are on separate networks, we also need to expose all user services (*.local) on the east-west gateway in both clusters. While this gateway is public on the Internet, services behind it can only be accessed by services with a trusted mTLS certificate and workload ID, just as if they were on the same network.
Set the default network for cluster2
If the istio-system namespace is already created, we need to set the cluster’s network there:
Enable API Server Access to cluster2
Before we can configure the remote cluster, we first have to give the control
plane in cluster1
access to the API Server in cluster2
. This will do the
following:
Enables the control plane to authenticate connection requests from workloads running in
cluster2
. Without API Server access, the control plane will reject the requests.Enables discovery of service endpoints running in
cluster2
.
To provide API Server access to cluster2
, we generate a remote secret and
apply it to cluster1
:
Configure cluster2
as a remote
Save the address of cluster1
’s east-west gateway.
Now create a remote configuration on cluster2
.
Apply the configuration to cluster2
:
Install the east-west gateway in cluster2
As we did with cluster1
above, install a gateway in cluster2
that is dedicated
to east-west traffic and expose user services.
Wait for the east-west gateway to be assigned an external IP address:
Expose services in cluster2
As we did with cluster1
above, expose services via the east-west gateway.
Congratulations! You successfully installed an Istio mesh across primary and remote clusters on different networks!
Next Steps
You can now verify the installation11.