Google Kubernetes Engine
Follow these instructions to prepare a GKE cluster for Istio.
Create a new cluster.
$ export PROJECT_ID=`gcloud config get-value project` && \ export M_TYPE=n1-standard-2 && \ export ZONE=us-west2-a && \ export CLUSTER_NAME=${PROJECT_ID}-${RANDOM} && \ gcloud services enable container.googleapis.com && \ gcloud container clusters create $CLUSTER_NAME \ --cluster-version latest \ --machine-type=$M_TYPE \ --num-nodes 4 \ --zone $ZONE \ --project $PROJECT_ID
Retrieve your credentials for
kubectl
.$ gcloud container clusters get-credentials $CLUSTER_NAME \ --zone $ZONE \ --project $PROJECT_ID
Grant cluster administrator (admin) permissions to the current user. To create the necessary RBAC rules for Istio, the current user requires admin permissions.
$ kubectl create clusterrolebinding cluster-admin-binding \ --clusterrole=cluster-admin \ --user=$(gcloud config get-value core/account)
Multi-cluster communication
In some cases, a firewall rule must be explicitly created to allow cross-cluster traffic.
Gather information about your clusters’ network.
$ function join_by { local IFS="$1"; shift; echo "$*"; } $ ALL_CLUSTER_CIDRS=$(gcloud --project $PROJECT_ID container clusters list --format='value(clusterIpv4Cidr)' | sort | uniq) $ ALL_CLUSTER_CIDRS=$(join_by , $(echo "${ALL_CLUSTER_CIDRS}")) $ ALL_CLUSTER_NETTAGS=$(gcloud --project $PROJECT_ID compute instances list --format='value(tags.items.[0])' | sort | uniq) $ ALL_CLUSTER_NETTAGS=$(join_by , $(echo "${ALL_CLUSTER_NETTAGS}"))
Create the firewall rule.
$ gcloud compute firewall-rules create istio-multicluster-pods \ --allow=tcp,udp,icmp,esp,ah,sctp \ --direction=INGRESS \ --priority=900 \ --source-ranges="${ALL_CLUSTER_CIDRS}" \ --target-tags="${ALL_CLUSTER_NETTAGS}" --quiet