Istio

https://istio.io/v1.14/docs/
Admin
Istio is a service mesh platform that provides traffic management, security, observability, and...
Tokens:460,154
Snippets:5,713
Trust Score:10
Update:5 months ago
Show doc for...
Tokens:
Raw
### Quick Start Prometheus Installation

Source: https://istio.io/v1.14/docs/ops/integrations/prometheus

Use this command to quickly deploy a basic Prometheus instance for demonstration purposes. This installation is not optimized for performance or security.

```bash
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/prometheus.yaml
```

--------------------------------

### Istio v1.14 Setup and Installation

Source: https://istio.io/v1.14/docs/releases/log

Guides for setting up Istio, including platform-specific installations, external control planes, CNI, and sidecar injection.

```APIDOC
## Istio v1.14 Setup and Installation

This section covers various methods and considerations for installing and setting up Istio version 1.14.

### Installation Guides

*   **Platform Setup:**
    *   [Kind](https://istio.io/v1.14/docs/setup/platform-setup/kind/)
    *   [Tencent Cloud Mesh](https://istio.io/v1.14/docs/setup/platform-setup/tencent-cloud-mesh/)
*   **Installation Methods:**
    *   [Operator Installation](https://istio.io/v1.14/docs/setup/install/operator/)
    *   [External Control Plane](https://istio.io/v1.14/docs/setup/install/external-controlplane/)
*   **Additional Setup:**
    *   [Sidecar Injection](https://istio.io/v1.14/docs/setup/additional-setup/sidecar-injection/)
    *   [CNI Installation](https://istio.io/v1.14/docs/setup/additional-setup/cni/)
    *   [Configuration Profiles](https://istio.io/v1.14/docs/setup/additional-setup/config-profiles/)

### Upgrade Guide

*   [Canary Upgrades](https://istio.io/v1.14/docs/setup/upgrade/canary/)
```

--------------------------------

### Setup Namespaces and Deploy Services

Source: https://istio.io/v1.14/docs/tasks/security/authentication/authn-policy

Creates namespaces and deploys httpbin and sleep services with Envoy proxies. This setup is required for the authentication policy examples.

```bash
$ kubectl create ns foo
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml7) -n foo
$ kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml8) -n foo
$ kubectl create ns bar
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml7) -n bar
$ kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml8) -n bar
$ kubectl create ns legacy
$ kubectl apply -f samples/httpbin/httpbin.yaml7 -n legacy
$ kubectl apply -f samples/sleep/sleep.yaml8 -n legacy
```

--------------------------------

### Install SPIRE Quickstart

Source: https://istio.io/v1.14/docs/ops/integrations/spire

Apply the provided YAML to quickly deploy SPIRE, the SPIFFE CSI Driver, and the SPIRE Kubernetes Workload Registrar into your cluster.

```bash
$ kubectl apply -f samples/security/spire/spire-quickstart.yaml
```

--------------------------------

### Quick Start Jaeger Installation

Source: https://istio.io/v1.14/docs/ops/integrations/jaeger

Use this command to quickly deploy a basic Jaeger instance into your cluster for demonstration purposes. This installation is not optimized for performance or security.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/jaeger.yaml
```

--------------------------------

### Quick Start Grafana Installation for Istio

Source: https://istio.io/v1.14/docs/ops/integrations/grafana

Use this command to quickly deploy a basic Grafana instance with Istio dashboards. Intended for demonstration, not production.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/grafana.yaml

```

--------------------------------

### Install Node.js Dependencies

Source: https://istio.io/v1.14/docs/examples/microservices-istio/single

Run 'npm install' in the service's directory to download and install all necessary Node.js dependencies as defined in the package.json file. This step is crucial before starting the service.

```bash
$ npm install

npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN ratings No description
npm WARN ratings No repository field.
npm WARN ratings No license field.

added 24 packages in 2.094s
```

--------------------------------

### Quick Start Kiali Installation

Source: https://istio.io/v1.14/docs/ops/integrations/kiali

Use this command to quickly deploy Kiali into your cluster for demonstration purposes. This is not tuned for performance or security. If publicly exposing Kiali, change the signing_key in the ConfigMap for non-anonymous authentication.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/kiali.yaml
```

--------------------------------

### Generate and Install East-West Gateway (Multi-Network)

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Generate the configuration for an east-west gateway for a multi-network setup and pipe it to 'istioctl install'. This command requires specifying the mesh, cluster, and network details.

```bash
$ samples/multicluster/gen-eastwest-gateway.sh \
--mesh mesh1 --cluster "${CLUSTER}" --network "${CLUSTER_NETWORK}" | \
istioctl install -y -f -
```

--------------------------------

### Start Istio Agent

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Start the Istio agent service on the virtual machine using systemctl.

```bash
sudo systemctl start istio
```

--------------------------------

### Install Istio with operator config file

Source: https://istio.io/v1.14/docs/tasks/observability/logs/otel-provider

Install Istio using the `istioctl install` command with a specified Istio operator configuration file.

```bash
$ istioctl install -f <your-istio-operator-config-file>
```

--------------------------------

### istioctl install command syntax

Source: https://istio.io/v1.14/docs/reference/commands/istioctl

The basic syntax for the istioctl install command.

```bash
istioctl install [flags]
```

--------------------------------

### Basic CLI Command Example

Source: https://istio.io/v1.14/docs/releases/contribute/code-blocks

Use the `text` shortcode with the `bash` attribute for CLI commands. Start each command with a `$` symbol. The output renders as plain text.

```bash
{{< text bash >}}
$ echo "Hello"
{{< /text >}}
```

--------------------------------

### Install Istio with Preview Profile

Source: https://istio.io/v1.14/docs/reference/config/proxy_extensions/wasm_telemetry

Install Istio using the 'preview' profile to enable Wasm-based telemetry by default. This is a simple command-line installation.

```bash
$ istioctl install --set profile=preview

```

--------------------------------

### Execute KubeSphere Installation Script

Source: https://istio.io/v1.14/docs/setup/platform-setup/kubesphere

Run this script to install a standard Kubernetes cluster. Select the '1) All-in-one' option when prompted.

```bash
./install.sh
```

--------------------------------

### Enable egress gateway with istioctl install

Source: https://istio.io/v1.14/docs/tasks/traffic-management/egress/egress-gateway

Alternatively, enable the egress gateway using the `istioctl install` command by setting the appropriate flags. Replace `<flags-you-used-to-install-Istio>` with your original installation flags.

```bash
$ istioctl install <flags-you-used-to-install-Istio> \
                   --set components.egressGateways[0].name=istio-egressgateway \
                   --set components.egressGateways[0].enabled=true

```

--------------------------------

### Install MicroK8s

Source: https://istio.io/v1.14/docs/setup/platform-setup/microk8s

Installs the latest version of MicroK8s using snap. This is the initial step to prepare your environment.

```bash
$ sudo snap install microk8s --classic

```

--------------------------------

### istioctl verify-install

Source: https://istio.io/v1.14/docs/reference/commands/istioctl

Verifies Istio installation status against the installation file. It checks if all resources defined in the installation file are in a ready state.

```APIDOC
## istioctl verify-install

### Description
Verifies Istio installation status against the installation file you specified when you installed Istio. It loops through all the installation resources defined in your installation file and reports whether all of them are in ready status. It will report failure when any of them are not ready. If you do not specify an installation it will check for an IstioOperator resource and will verify if pods and services defined in it are present.
Note: For verifying whether your cluster is ready for Istio installation, see istioctl experimental precheck.

### Method
`istioctl`

### Endpoint
`/verify-install`

### Parameters
#### Path Parameters
None

#### Query Parameters
- **-f, --filename** (stringSlice) - Required - Istio YAML installation file.
- **-i, --istioNamespace** (string) - Optional - Istio system namespace (default `istio-system`).
- **-c, --kubeconfig** (string) - Optional - Kubernetes configuration file.
- **-d, --manifests** (string) - Optional - Specify a path to a directory of charts and profiles (e.g. ~/Downloads/istio-1.14.0/manifests) or release tar URL (e.g. https://github.com/istio/istio/releases/download/1.14.0/istio-1.14.0-linux-amd64.tar.gz).
- **-n, --namespace** (string) - Optional - Config namespace.
- **-r, --revision** (string) - Optional - Control plane revision.
- **--context** (string) - Optional - The name of the kubeconfig context to use.
- **--vklog** (Level) - Optional - Number for the log level verbosity. Like -v flag. ex: --vklog=9 (default `0`).

### Request Example
```
istioctl verify-install -f $HOME/istio.yaml
```

### Response
#### Success Response (200)
- **status** (string) - Indicates the installation status.

#### Response Example
```json
{
  "status": "installed"
}
```
```

--------------------------------

### Install Istio with a New Trust Domain

Source: https://istio.io/v1.14/docs/tasks/security/authorization/authz-td-migration

Use this command to install Istio with a specified new trust domain. Ensure you have `istioctl` installed.

```bash
$ istioctl install --set profile=demo --set meshConfig.trustDomain=new-td
```

--------------------------------

### Download KubeSphere Installer

Source: https://istio.io/v1.14/docs/setup/platform-setup/kubesphere

Use this command to download the KubeSphere installer. Ensure you are in the KubeSphere directory after downloading.

```bash
$ curl -L https://kubesphere.io/download/stable/latest > installer.tar.gz
$ tar -xzf installer.tar.gz
$ cd kubesphere-all-v2.1.1/scripts
```

--------------------------------

### Install Istio with Demo Profile using Operator

Source: https://istio.io/v1.14/docs/setup/install/operator

Apply an IstioOperator resource to install Istio with the 'demo' profile. The operator controller will detect this resource and initiate the installation.

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: example-istiocontrolplane
spec:
  profile: demo

```

--------------------------------

### Client DNS Resolution Example

Source: https://istio.io/v1.14/docs/ops/configuration/traffic-management/dns

Demonstrates a client performing DNS resolution for a domain. The example shows `example.com` resolving to `192.0.2.0`.

```bash
$ curl example.com -v

*   Trying 192.0.2.0:80...

```

--------------------------------

### Install Istio Ingress Gateway

Source: https://istio.io/v1.14/docs/setup/install/external-controlplane

Install the configured Istio ingress gateway into the `istio-system` namespace of the external cluster using `istioctl install`. Replace `${CTX_EXTERNAL_CLUSTER}` with your cluster context.

```bash
$ istioctl install -f controlplane-gateway.yaml --context="${CTX_EXTERNAL_CLUSTER}"
```

--------------------------------

### Apply a default Istio installation

Source: https://istio.io/v1.14/docs/reference/commands/istioctl

Use this command to apply a default Istio installation without any specific configurations.

```bash
istioctl install
```

--------------------------------

### Deploy Sample Applications

Source: https://istio.io/v1.14/docs/setup/install/external-controlplane

Deploys the 'helloworld' (v2) and 'sleep' sample applications to the 'sample' namespace on the specified cluster context.

```bash
$ kubectl apply -f samples/helloworld/helloworld.yaml8 -l service=helloworld -n sample --context="${CTX_SECOND_CLUSTER}"
$ kubectl apply -f samples/helloworld/helloworld.yaml8 -l version=v2 -n sample --context="${CTX_SECOND_CLUSTER}"
$ kubectl apply -f samples/sleep/sleep.yaml9 -n sample --context="${CTX_SECOND_CLUSTER}"
```

--------------------------------

### Attribute Generation Match Condition Example

Source: https://istio.io/v1.14/docs/reference/config/proxy_extensions/attributegen

Example of a CEL condition for matching a request path that starts with '/books/' and allows GET or HEAD methods. Ensure to use anchors for efficient regex evaluation.

```json
{
    "value": "ReadOnlyBooks",
    "condition": "request.url_path.startsWith('/books/') &&
    in(request.method, ['GET', 'HEAD'])"
  }
```

--------------------------------

### Deploy Sample Applications

Source: https://istio.io/v1.14/docs/setup/install/external-controlplane

Deploys the 'helloworld' and 'sleep' sample applications to the 'sample' namespace on the remote cluster.

```bash
$ kubectl apply -f samples/helloworld/helloworld.yaml8 -l service=helloworld -n sample --context="${CTX_REMOTE_CLUSTER}"
$ kubectl apply -f samples/helloworld/helloworld.yaml8 -l version=v1 -n sample --context="${CTX_REMOTE_CLUSTER}"
$ kubectl apply -f samples/sleep/sleep.yaml9 -n sample --context="${CTX_REMOTE_CLUSTER}"
```

--------------------------------

### Define Request Operations for AuthorizationPolicy

Source: https://istio.io/v1.14/docs/reference/config/security/authorization-policy

Specify hosts, methods, and paths to match requests. Fields are ANDed together. For example, this matches hosts ending in '.example.com', with GET or HEAD methods, and paths not starting with '/admin'.

```yaml
hosts: ["*.example.com"]
methods: ["GET", "HEAD"]
notPaths: ["/admin*"]
```

--------------------------------

### Install Kiali and Addons

Source: https://istio.io/v1.14/docs/setup/getting-started

Apply the addon configuration and monitor the Kiali deployment rollout. Ensure all replicas are available before proceeding.

```bash
$ kubectl apply -f samples/addons
$ kubectl rollout status deployment/kiali -n istio-system

Waiting for deployment "kiali" rollout to finish: 0 of 1 updated replicas are available...
deployment "kiali" successfully rolled out
```

--------------------------------

### Node.js Ratings Service

Source: https://istio.io/v1.14/docs/examples/microservices-istio/single

Example Node.js code for a ratings service, often used in microservices examples. Ensure Node.js is installed.

```javascript
/**
 * Copyright 2015 Google Inc. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

// node-express-example-app.js
const express = require('express');
const app = express();

const ratingsData = {
    "1": {"name": "1", "ratings": {"Reviewer1": 5, "Reviewer2": 5}},
    "2": {"name": "2", "ratings": {"Reviewer1": 5, "Reviewer2": 4}},
    "3": {"name": "3", "ratings": {"Reviewer1": 4, "Reviewer2": 5}},
    "4": {"name": "4", "ratings": {"Reviewer1": 3, "Reviewer2": 5}},
    "5": {"name": "5", "ratings": {"Reviewer1": 5, "Reviewer2": 5}}
};

app.get('/ratings/:itemId', (req, res) => {
    const itemId = req.params.itemId;
    const item = ratingsData[itemId];
    if (item) {
        console.log("Returning ratings for item: " + itemId);
        res.send(item.ratings);
    } else {
        console.log("No ratings found for item: " + itemId);
        res.status(404).send('Item not found');
    }
});

const port = 9080;
app.listen(port, () => {
    console.log(`Ratings service listening on port ${port}`);
});

```

```json
{
    "name": "ratings",
    "version": "1.0.0",
    "description": "Ratings microservice for the Bookinfo sample",
    "main": "ratings.js",
    "scripts": {
        "start": "node ratings.js"
    },
    "dependencies": {
        "express": "^4.18.2"
    }
}

```

--------------------------------

### Example C++ Proxy-Wasm Plugin

Source: https://istio.io/v1.14/docs/concepts/wasm

This is an example C++ Proxy-Wasm plugin for a filter. Refer to the linked guide for implementing a Wasm extension with C++.

```cpp
#include "proxy_wasm_intrinsics.h"

currentChar = "hello";

extern "C" __attribute__((export_name("envoy_init"))) uint32_t envoy_init() {
    return 1;
}

extern "C" __attribute__((export_name("envoy_on_request"))) void envoy_on_request(uint32_t id) {
    // Called when a request is received.
    // You can inspect and modify the request headers, body, etc.
    // For example, to log a header:
    // log(LogLevel::Info, "My header value: " + getHeaderMapValue(HeaderMapType::Request, "my-header"));

    // To add a header:
    // setHeaderMapValue(HeaderMapType::Request, "x-custom-header", "my-value");

    // To call another service:
    // auto result = makeHttpRequest( 
    //     "example.com", 
    //     "/path", 
    //     {}, 
    //     {}, 
    //     10000, 
    //     nullptr, 
    //     nullptr);

    // To send a response directly:
    // sendLocalResponse(200, "OK", "Hello from Wasm!", 
    //     {{":content-type", "text/plain"}}, 
    //     {});
}

extern "C" __attribute__((export_name("envoy_on_response"))) void envoy_on_response(uint32_t id) {
    // Called when a response is received.
    // You can inspect and modify the response headers, body, etc.
    // log(LogLevel::Info, "Response received.");
}

```

--------------------------------

### Deploy Example Namespace and Workloads

Source: https://istio.io/v1.14/docs/tasks/security/authorization/authz-deny

Use these kubectl commands to create the 'foo' namespace and deploy the httpbin and sleep workloads, injecting Istio sidecar proxies.

```bash
kubectl create ns foo
kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n foo
kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml) -n foo
```

--------------------------------

### Install Istio with Default Profile

Source: https://istio.io/v1.14/docs/setup/install/istioctl

Installs the default Istio configuration profile on the current Kubernetes cluster. This is a good starting point for production environments.

```bash
$ istioctl install

```

--------------------------------

### Example Source Configuration

Source: https://istio.io/v1.14/docs/reference/config/security/authorization-policy

This example demonstrates how to configure a Source to match requests from specific principals, namespaces, and exclude certain IP addresses. Ensure mTLS and request authentication are enabled for principal matching.

```yaml
principals: ["admin", "dev"]
namespaces: ["prod", "test"]
notIpBlocks: ["1.2.3.4"]
```

--------------------------------

### HelloWorld Response Example

Source: https://istio.io/v1.14/docs/setup/install/multicluster/verify

Example output from the HelloWorld service, showing toggling between versions v1 and v2. This indicates successful load balancing.

```text
Hello version: v2, instance: helloworld-v2-758dd55874-6x4t8
Hello version: v1, instance: helloworld-v1-86f77cd7bd-cpxhv
...
```

--------------------------------

### Start helloworld-v1 Sample Service and Deployment

Source: https://istio.io/v1.14/docs/tasks/traffic-management/ingress/secure-ingress

This YAML definition deploys the helloworld-v1 service and its corresponding deployment. Ensure the image is accessible and resources are sufficient for your environment.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: helloworld-v1
  labels:
    app: helloworld-v1
spec:
  ports:
  - name: http
    port: 5000
  selector:
    app: helloworld-v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: helloworld-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: helloworld-v1
      version: v1
  template:
    metadata:
      labels:
        app: helloworld-v1
        version: v1
    spec:
      containers:
      - name: helloworld
        image: istio/examples-helloworld-v1
        resources:
          requests:
            cpu: "100m"
        imagePullPolicy: IfNotPresent #Always
        ports:
        - containerPort: 5000
```

--------------------------------

### Enable Hold Application Until Proxy Starts (Global)

Source: https://istio.io/v1.14/docs/ops/common-problems/injection

Configure this globally in your Istio installation to ensure applications wait for the istio-proxy to be ready before starting. This is useful for applications that require network connectivity during startup.

```yaml
values.global.proxy.holdApplicationUntilProxyStarts: true

```

--------------------------------

### Apply Bookinfo Sample Configuration

Source: https://istio.io/v1.14/docs/tasks/traffic-management/request-timeouts

Applies the initial configuration for the Bookinfo sample application, including default destination rules.

```bash
$ kubectl apply -f samples/bookinfo/networking/virtual-service-all-v1.yaml7
```

--------------------------------

### Install Istio with Default Profile

Source: https://istio.io/v1.14/docs/tasks/observability/logs/access-log

Command to install Istio using the default profile. This command is used as an example for disabling Envoy's access logging by removing or setting meshConfig.accessLogFile to an empty string.

```bash
$ istioctl install --set profile=default

```

--------------------------------

### Example Log Entry for Egress Request

Source: https://istio.io/v1.14/docs/tasks/traffic-management/egress/egress-tls-origination

This is an example log line from the `istio-proxy` container, indicating a successful GET request to `my-nginx.mesh-external.svc.cluster.local:443` with a 200 status code, confirming the egress traffic and TLS origination.

```text
[2022-05-19T10:01:06.795Z] "GET / HTTP/1.1" 200 - via_upstream - "" 0 615 1 0 "" "curl/7.83.1-DEV" "96e8d8a7-92ce-9939-aa47-9f5f530a69fb" "my-nginx.mesh-external.svc.cluster.local:443" "10.107.176.65:443"
```

--------------------------------

### Deploy Sample Applications and Namespaces

Source: https://istio.io/v1.14/docs/tasks/security/authorization/authz-td-migration

Enables Istio injection for namespaces and deploys the httpbin and sleep sample applications. Ensure these are set up before applying authorization policies.

```bash
$ kubectl label namespace default istio-injection=enabled
$ kubectl apply -f samples/httpbin/httpbin.yaml8
$ kubectl apply -f samples/sleep/sleep.yaml9
$ kubectl create namespace sleep-allow
$ kubectl label namespace sleep-allow istio-injection=enabled
$ kubectl apply -f samples/sleep/sleep.yaml9 -n sleep-allow
```

--------------------------------

### Generate and Install East-West Gateway (Single Network)

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Generate the configuration for an east-west gateway for a single-network setup and pipe it to 'istioctl install'. This gateway is crucial for enabling communication between services in different networks or clusters.

```bash
$ samples/multicluster/gen-eastwest-gateway.sh --single-cluster | istioctl install -y -f -
```

--------------------------------

### Install Istio using a Configuration File

Source: https://istio.io/v1.14/docs/setup/install/istioctl

Installs Istio using a specified IstioOperator configuration file. This method is strongly recommended for production environments over using `--set` flags.

```bash
$ istioctl install -f my-config.yaml

```

--------------------------------

### Example Egress Gateway Log Entry

Source: https://istio.io/v1.14/docs/tasks/traffic-management/egress/egress-gateway-tls-origination

A sample log entry from the egress gateway indicating a successful GET request to the specified external service.

```text
[2018-08-19T18:20:40.096Z] "GET / HTTP/1.1" 200 - 0 612 7 5 "172.30.146.114" "curl/7.35.0" "b942b587-fac2-9756-8ec6-303561356204" "my-nginx.mesh-external.svc.cluster.local" "172.21.72.197:443"
```

--------------------------------

### Create Allow Policy for Path IP

Source: https://istio.io/v1.14/docs/tasks/security/authorization/authz-deny

Applies an AuthorizationPolicy to allow GET requests to the /ip path for the httpbin workload. This is an example of an allow policy.

```yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-path-ip
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
  - to:
    - operation:
        paths: ["/ip"]

```

--------------------------------

### Start Minikube with Resources

Source: https://istio.io/v1.14/docs/setup/platform-setup/minikube

Start Minikube with specified memory and CPU, and a particular Kubernetes version. Ensure sufficient memory is allocated to avoid potential issues like image pull failures or timeouts.

```bash
$ minikube start --memory=16384 --cpus=4 --kubernetes-version=v1.20.2

```

--------------------------------

### Deploy httpbin Sample

Source: https://istio.io/v1.14/docs/tasks/traffic-management/circuit-breaking

Apply the httpbin sample service. If automatic sidecar injection is enabled, use kubectl apply. Otherwise, manually inject the sidecar using istioctl kube-inject.

```bash
$ kubectl apply -f samples/httpbin/httpbin.yaml7
```

```bash
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml7)
```

--------------------------------

### Bash Completion Setup for Pilot-Agent

Source: https://istio.io/v1.14/docs/reference/commands/pilot-agent

Set up bash completion for the pilot-agent command. After running this command, start a new shell session for the changes to take effect.

```bash
pilot-agent completion bash > /usr/local/etc/bash_completion.d/pilot-agent
```

```bash
pilot-agent completion bash
```

--------------------------------

### Install Istio with Demo Profile

Source: https://istio.io/v1.14/docs/setup/install/istioctl

Installs Istio using the 'demo' configuration profile. This profile is intended for evaluating a broad set of Istio features.

```bash
$ istioctl install --set profile=demo

```

--------------------------------

### Deploy httpbin sample app

Source: https://istio.io/v1.14/docs/tasks/observability/logs/access-log

Deploys the httpbin sample application. Use this command if automatic sidecar injection is enabled.

```bash
$ kubectl apply -f samples/httpbin/httpbin.yaml
```

--------------------------------

### IstioOperator Custom Resource Example

Source: https://istio.io/v1.14/docs/reference/config/istio.operator.v1alpha1

Defines the desired installed state of Istio components, including profile, hub, tag, revision, mesh configuration, and component settings.

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  hub: gcr.io/istio-testing
  tag: latest
  revision: 1-8-0
  meshConfig:
    accessLogFile: /dev/stdout
    enableTracing: true
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true

```

--------------------------------

### Describe Istiod Pods

Source: https://istio.io/v1.14/docs/ops/common-problems/validation

Get detailed information about Istiod pods, including their status, events, and configuration. This is useful for diagnosing why pods might not be starting or serving traffic.

```bash
$ for pod in $(kubectl -n istio-system get pod -lapp=istiod -o name); do \
    kubectl -n istio-system describe ${pod} \
done
```

--------------------------------

### Deploy Sample Applications and Enable Injection

Source: https://istio.io/v1.14/docs/tasks/security/cert-management/custom-ca-k8s

Label the `foo` and `bar` namespaces to enable Istio sidecar injection, then deploy the `httpbin` and `sleep` sample applications into both namespaces.

```bash
$ kubectl label ns foo istio-injection=enabled
$ kubectl label ns bar istio-injection=enabled
$ kubectl apply -f samples/httpbin/httpbin.yaml -n foo
$ kubectl apply -f samples/sleep/sleep.yaml -n foo
$ kubectl apply -f samples/httpbin/httpbin.yaml -n bar
$ kubectl apply -f samples/sleep/sleep.yaml -n bar

```

--------------------------------

### Configure Cluster2 as Primary

Source: https://istio.io/v1.14/docs/setup/install/multicluster/multi-primary_multi-network

Defines the IstioOperator configuration for cluster2, mirroring the setup for cluster1 but with 'cluster2' as the cluster name and 'network2' as the network. Apply this configuration using 'istioctl install'.

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      meshID: mesh1
      multiCluster:
        clusterName: cluster2
      network: network2
```

```bash
$ istioctl install --context="${CTX_CLUSTER2}" -f cluster2.yaml
```

--------------------------------

### Deploy otel-collector sample

Source: https://istio.io/v1.14/docs/tasks/observability/logs/otel-provider

Deploy the OpenTelemetry collector sample.

```bash
$ kubectl apply -f samples/open-telemetry/otel.yaml
```

--------------------------------

### Observe the Dockerfile

Source: https://istio.io/v1.14/docs/examples/microservices-istio/package-service

Use cat to display the contents of the Dockerfile. Note that it copies files into the container and runs 'npm install'. The CMD command starts the ratings service on port 9080.

```bash
$ cat Dockerfile
```

--------------------------------

### Deploy HelloWorld Service

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Apply the Kubernetes configuration file to deploy the 'HelloWorld' service in the 'sample' namespace.

```bash
$ kubectl apply -n sample -f samples/helloworld/helloworld.yaml13
```

--------------------------------

### HTTPMatchRequest with Prefix URI and Header Match (v1alpha3)

Source: https://istio.io/v1.14/docs/reference/config/networking/virtual-service

This example demonstrates matching requests where the URI starts with '/ratings/v2/' and a specific 'end-user' header is present. This configuration is for Istio API version v1alpha3.

```yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings-route
spec:
  hosts:
  - ratings.prod.svc.cluster.local
  http:
  - match:
    - headers:
        end-user:
          exact: jason
      uri:
        prefix: "/ratings/v2/"
      ignoreUriCase: true
    route:
    - destination:
        host: ratings.prod.svc.cluster.local


```

--------------------------------

### Apply Bookinfo Sample Networking Configurations

Source: https://istio.io/v1.14/docs/tasks/traffic-management/fault-injection

Apply the necessary Istio configurations for the Bookinfo sample application, including default destination rules and a specific test version for reviews.

```bash
$ kubectl apply -f samples/bookinfo/networking/virtual-service-all-v1.yaml
$ kubectl apply -f samples/bookinfo/networking/virtual-service-reviews-test-v2.yaml
```

--------------------------------

### JWT validation, principal check, and routing based on claims

Source: https://istio.io/v1.14/docs/reference/config/security/request_authentication

This example demonstrates a complete setup for ingress gateways: RequestAuthentication to validate JWTs, AuthorizationPolicy to enforce authenticated principals, and VirtualService to route based on JWT claims like 'sub'. This enables advanced routing logic for authenticated users.

```yaml
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-on-ingress
  namespace: istio-system
spec:
 selector:
   matchLabels:
     app: istio-ingressgateway
  jwtRules:
  - issuer: "example.com"
    jwksUri: https://example.com/.well-known/jwks.json
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: istio-system
spec:
 selector:
   matchLabels:
     app: istio-ingressgateway
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: route-jwt
spec:
  hosts:
  - foo.prod.svc.cluster.local
  gateways:
  - istio-ingressgateway
  http:
  - name: "v2"
    match:
    - headers:
        "@request.auth.claims.sub":
          exact: "dev"
    route:
    - destination:
        host: foo.prod.svc.cluster.local
        subset: v2

```

--------------------------------

### Install Istio with Demo Profile

Source: https://istio.io/v1.14/docs/tasks/security/cert-management/plugin-ca-cert

Installs Istio using the 'demo' profile. Istio will automatically detect and use the custom CA certificates and keys provided in the 'cacerts' secret.

```bash
istioctl install --set profile=demo
```

--------------------------------

### Install Bash Completion on macOS

Source: https://istio.io/v1.14/docs/ops/diagnostic-tools/istioctl

Install the bash-completion package on macOS using the brew package manager if it is not already installed.

```bash
$ brew install bash-completion
```

--------------------------------

### Install Zipkin Add-on

Source: https://istio.io/v1.14/docs/ops/integrations/zipkin

Use this command to quickly deploy a basic Zipkin instance into your Kubernetes cluster. This is for demonstration purposes and not optimized for production.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/addons/extras/zipkin.yaml
```

--------------------------------

### Install Mesh Configuration

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Copy the generated mesh.yaml file to the /etc/istio/config/mesh directory on the virtual machine.

```bash
sudo cp "${HOME}"/mesh.yaml /etc/istio/config/mesh
```

--------------------------------

### Generate Istio Installation Manifest

Source: https://istio.io/v1.14/docs/setup/install/istioctl

Generate the Istio installation manifest before deployment. Replace `<your original installation options>` with your specific configuration.

```bash
$ istioctl manifest generate <your original installation options> > $HOME/generated-manifest.yaml
```

--------------------------------

### Install Istio with Access Logs Enabled

Source: https://istio.io/v1.14/docs/setup/install/istioctl

Installs Istio with access logging enabled, directing logs to standard output. This uses the `--set` flag for configuration.

```bash
$ istioctl install --set meshConfig.accessLogFile=/dev/stdout

```

--------------------------------

### Create and Label Namespace for Sample Service

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Create a Kubernetes namespace named 'sample' and label it to enable Istio injection for deploying services.

```bash
$ kubectl create namespace sample
$ kubectl label namespace sample istio-injection=enabled
```

--------------------------------

### Deploy Sample External Authorizer

Source: https://istio.io/v1.14/docs/tasks/security/authorization/authz-custom

Applies the configuration to deploy the sample external authorizer service and deployment within the 'foo' namespace.

```bash
kubectl apply -n foo -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/extauthz/ext-authz.yaml
```

--------------------------------

### Install Istio Manifest

Source: https://istio.io/v1.14/docs/reference/commands/istioctl

Generates and applies an Istio install manifest to a cluster. Use flags to customize the installation, such as enabling features or specifying profiles.

```bash
istioctl manifest install [flags]
```

```bash
istioctl manifest apply [flags]
```

```bash
istioctl install
```

```bash
istioctl install --set meshConfig.enableTracing=true
```

```bash
istioctl install --set profile=demo --skip-confirmation
```

```bash
istioctl install --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
```

```bash
istioctl install --set meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_VIA_AGENT=\"false\"
```

--------------------------------

### Install Gateway API CRDs

Source: https://istio.io/v1.14/docs/tasks/traffic-management/ingress/gateway-api

Install the Gateway API CRDs if they are not already present on your cluster. This command checks for existing CRDs and installs them if missing.

```bash
$ kubectl get crd gateways.gateway.networking.k8s.io || { kubectl kustomize "github.com/kubernetes-sigs/gateway-api/config/crd?ref=v0.4.0" | kubectl apply -f -; }
```

--------------------------------

### Install Istio Sidecar RPM Package

Source: https://istio.io/v1.14/docs/setup/install/virtual-machine

Install the Istio virtual machine integration runtime by downloading and installing the .rpm package for CentOS systems.

```bash
curl -LO https://storage.googleapis.com/istio-release/releases/1.14.3/rpm/istio-sidecar.rpm
sudo rpm -i istio-sidecar.rpm
```
Tokens:
Raw