Example Application using Virtual Machines in a Single Network Mesh
This example provides instructions to integrate a virtual machine or a bare metal host into a single network Istio mesh deployed on Kubernetes. This approach requires L3 connectivity between the virtual machine and the Kubernetes cluster.
Prerequisites
One or more Kubernetes clusters with versions: 1.16, 1.17, 1.18, 1.19.
Virtual machines must have L3 IP connectivity to the endpoints in the mesh. This typically requires a VPC or a VPN, as well as a container network that provides direct (without NAT or firewall deny) routing to the endpoints. The machine is not required to have access to the cluster IP addresses assigned by Kubernetes.
Installation must be completed using virtual machine installation2 instructions.
Verify installation
After installation, the virtual machine can access services running in the Kubernetes cluster or in
other virtual machines. To verify the virtual machine connectivity, run the following command
(assuming you have a service named httpbin
on the Kubernetes cluster:
This shows endpoints for httpbin
:
The IP 34.72.46.113
in this case is the pod IP address of the httpbin endpoint.
Send requests from virtual machine workloads to Kubernetes services
You can send traffic to httpbin.default.svc.cluster.local
and get a response from the server. You must configure DNS in /etc/hosts
to map the httpbin.default.svc.cluster.local
domain name to an IP, or the IP will not resolve. In this case, the IP should be an IP that is routed over the single network using L3 connectivity. You should use the IP of the service in the Kubernetes cluster.
Running services on the virtual machine
Setup an HTTP server on the virtual machine to serve HTTP traffic on port 8080:
Add virtual machine services to the mesh
Add a service to the Kubernetes cluster into a namespace (in this example,
<vm-namespace>
) where you prefer to keep resources (likeService
,ServiceEntry
,WorkloadEntry
,ServiceAccount
) with the virtual machine services:Create a
WorkloadEntry
with the external IP of the virtual machine. SubstituteVM_IP
with the IP of your virtual machine:Deploy a pod running the
sleep
service in the Kubernetes cluster, and wait until it is ready:Send a request from the
sleep
service on the pod to the virtual machine HTTP service:You will see output similar to this:
Congratulations! You successfully configured a service running in a pod within the cluster to send traffic to a service running on a VM outside of the cluster and tested that the configuration worked.
Cleanup
At this point, you can remove the virtual machine resources from the Kubernetes cluster in the <vm-namespace>
namespace.
Troubleshooting
The following are some basic troubleshooting steps for common VM-related issues.
When making requests from a VM to the cluster, ensure you don’t run the requests as
root
oristio-proxy
user. By default, Istio excludes both users from interception.Verify the machine can reach the IP of the all workloads running in the cluster. For example:
Check the status of the Istio Agent and sidecar:
Check that the processes are running. The following is an example of the processes you should see on the VM if you run
ps
, filtered foristio
:Check the Envoy access and error logs for failures: