Istio Key points — part 2

Installing and Updating Istio

Istio can be installed using a variety of methods. Check out the Istio installation documentation to help you decide which method works best for your setup. We will be using the istioctl manifest generate process, which is suitable when strict auditing or augmentation of output manifests is needed.

Get Lamai Anthony’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

STEPS

1. Download the Istio package. Here is a link to the Istio GitHub release repository.

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.16.4 TARGET_ARCH=x86_64 sh -

2. Cd into the Istio directory.

cd istio-1.16.4

3. Add the Istioctl client to Path.

export PATH=$PWD/bin:$PATH

4. Generate Istio manifest.

istioctl manifest generate > $HOME/istio-manifest.yaml

5. Create Istio-system namespace. The Istio namespace must be created manually when using the manifest generate method.

kubectl create -n istio-system

6. Install Istio profile with a revision tag

istioctl istall -y --set profile=<profile name> --revision <tag name> -f $HOME/istio-manifest.yaml

7. Enable Istio sidecar injection on the Kubernetes workspace. For example, to enable sidecar injection on the default namespace run

kubectl label namespace default istio-injection=enabled --overwrite
kubectl get namespace -L istio-injection

8. Ensure that there are no issues with the configuration by checking

istioctl analyze

istioctl proxy-status

istioctl verify-install -f $HOME/istio-manifest.yaml

Now when you deploy workloads to the sidecar injection enabled namespace, Istio will automatically deploy Envoy proxies to the pods.

kubectl label namespace <namespace name> istio-injection=enabled --overwrite
kubectl get namespace -L istio-injection

Currently, there are three supported methods for upgrading Istio. In order to avoid downtime in production, it is recommended to use canary deployment. To perform the upgrade, follow the commands listed below. This will install the newer version of Istiod and perform an in-place update of your ingress gateway service.

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.17.2 TARGET_ARCH=x86_64 sh -

cd istio-1.17.2

export PATH=$PWD/bin:$PATH

istioctl manifest generate > $HOME/istio-1-17-2-manifest.yaml

istioctl istall -y --set profile=<profile name> --revision <tag name> -f $HOME/istio-manifest.yaml

However, to ensure that when new pods are deployed the sidecar injector creates an Envoy proxy within the workload pods using the new Istio version, we run the below command.

kubectl label namespace <namespace> istio.io/rev=<new istio version tag name> --overwrite

At this point, we are almost done with the upgrade. We can simply run ‘kubectl rollout restart deployment -n <namespace>’ to restart the pods. However, this is not truly a canary upgrade because we are expecting to deploy our application in a new namespace that will have the new Istio sidecars. This will give us extra control in managing traffic between the old and new Istio versions, providing a better chance to observe and confirm if the new Istio version is working as expected. Although it can be expensive because we will be running twice our normal workload.

After creating the new namespace and deploying the workloads within it, we can edit the Virtual Service destination metrics to match our desired state, such as 50% of traffic going to the old Istio deployment and the remaining half going to the new Istio deployment. Once the team is confident, they can decide to forward the entire traffic to the new Istio deployment and then delete the old Istio deployment using the command below.

istioctl uninstall --revision <revision tag name>

For more information on upgrading Istio visit the Istio documentation website.