How can I retrieve the istio ingress gateway hosts for an HPE Ezmeral Container Platform managed clu

[charlottejenkin]

I have configured a K8S cluster with istio-ingressgateway as per the docs.

Although the HPE Container Platform managed haproxy gateway can route traffic to the istio-ingressgateway, I would like to access the host endpoints directly.

How can I determine the ingress IP addresses and ports for the hosts avoiding the managed haproxy gateway?

mybalancenow.com

[abe-hpe]

Hi Charlotte,

I know this is an old post, and you've probably got past this by now, but I just wanted to add a reply for the sake of completeness. The short answer is that by default, you can access your Istio gateways/virtual services directly on ports 80 and/or 443 of the host(s) that you tagged as istio-ingressgateway: true, bypassing the ECP gateway service endpoint mappings.

For others reading this, the document that describes configuring Istio ingress gateway hosts on your ECP Kubernetes cluster is here. When the Istio ingress gateway service is created (by enabling the Istio add-on at K8S cluster creation time) ECP automatically creates mappings in its gateway hosts to all the service endpoints exposed by the Istio ingress gateway service. 

To see which ECP gateway ports are mapped to which Istio ingress gateway service ports, run:

kubectl -n istio-system describe svc istio-ingressgateway

In addition to these mappings, we create specific per-tenant mappings to ports 80 and 443 of the ingress gateway service. These can be seen in the istio-ingress-import service inside the tenant's namespace, and are used to create the Virtual Endpoints seen under the 'Kubernetes Applications' menu in the tenant UI.

-Abe

[ukhpeuser]

Hi Abe,

Do you have any examples of the steps to go through to configure this?  We have Airflow configured, which has created an istio-ingressgateway, can we make use of this to connec tto virtualservices?  The documentation is incomplete as no examples\steps given.

Thanks

[Abe-S]

Hi,

After you have an istio ingress gateway configured and working on a Kubernetes cluster on your Ezmeral platform, you can treat it just like an ingress gateway on any Kubernetes cluster. To allow an existing Kubernetes service to be accessed via the ingress gateway, you need to create a 'Gateway' object and a 'VirtualService' object, for example:

apiVersion: networking.istio.io/v1alpha3

kind: Gateway

metadata:

  name: mygateway

spec:

  selector:

    istio: ingressgateway # use istio default ingress gateway

  servers:

  - port:

      number: 80

      name: http

      protocol: HTTP

    hosts:

    - "*"

---

apiVersion: networking.istio.io/v1alpha3

kind: VirtualService

metadata:

  name: nginx

spec:

  hosts:

  - "*"

  gateways:

  - mygateway

  http:

  - match:

    - uri:

        prefix: /mynginx/

    route:

    - destination:

        port:

          number: 80

        host: nginx

The Istio documentation has some good examples:

https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/

Hope that helps

-Abe