...
draw.io Diagram |
---|
border | true |
---|
| |
---|
diagramName | us-to-us intent |
---|
simpleViewer | false |
---|
width | |
---|
links | auto |
---|
tbstyle | top |
---|
lbox | true |
---|
diagramWidth | 15511538 |
---|
revision | 23 |
---|
|
NOTE - For this scenario, the default mesh wide policy must be set to "PERMISSIVE" on both the clusters. It will not work if the default Mesh Policy is "STRICT"
...
Code Block |
---|
language | yml |
---|
theme | Eclipse |
---|
title | ServiceEntry |
---|
linenumbers | true |
---|
|
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: servicename-httpbin
spec:
hosts:
- httpbin.defaultnamespace02.globallogicalcloud02
# template for the remote service name - <servicename.namespace.global>
# Treat remote cluster services as part of the service mesh
# as all clusters in the service mesh share the same root of trust.
location: MESH_INTERNAL
ports:
- name: http1
number: 8000
protocol: http
resolution: DNS
addresses:
# the IP address to which httpbin.<namespace>.<logicalcloudname> will resolve to
# must be unique for each remote service, within a given cluster.
# This address need not be routable. Traffic for this IP will be captured
# by the sidecar and routed appropriately.
- 240.0.0.2
endpoints:
# This is the routable address of the istio ingress gateway in cluster02
# routed to this address.
- address: 172.25.55.50
ports:
http1: 15443 //Sni. Do not change this
|
...
Code Block |
---|
language | yml |
---|
theme | Eclipse |
---|
title | DestinationRule |
---|
linenumbers | true |
---|
|
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: bookinfo-productpage-dr
namespace: default
spec:
host: "productpage.default.svc.cluster.local"
trafficPolicy:
tls:
mode: MUTUAL
serverCertificate: /etc/certs/cert-chain.pem
mode: ISTIO_MUTUALprivateKey: /etc/certs/key.pem
caCertificates: /etc/certs/root-cert.pem
loadbalancer:
consistentHash:
httpCookie: "user2"
connectionPool:
tcp:
maxConnections: 10
http:
http2MaxRequests: 1000
maxRequestsPerConnection: 100
outlierDetection:
consecutiveErrors: 7
interval: 5m
baseEjectionTime: 15m
|
...
Code Block |
---|
language | yml |
---|
theme | Eclipse |
---|
title | DestinationRule |
---|
linenumbers | true |
---|
|
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: sleep-dr
namespace: default
spec:
host: "sleep.default.svc.cluster.local"
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
mode: MUTUAL
serverCertificate: /etc/certs/cert-chain.pem
privateKey: /etc/certs/key.pem
caCertificates: /etc/certs/root-cert.pem
|
Cluster 02 Resources
1. ServiceEntry - To enable access to bookinfo-productpage
Code Block |
---|
language | yml |
---|
theme | Eclipse |
---|
title | ServiceEntry |
---|
linenumbers | true |
---|
|
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: servicename-bookinfo-productpage
spec:
hosts:
- productpage.default.globalnamespace01.logicalcloud01 // format is <svc>.<namespace>.<logical_cluster_domain>
# template for the remote service name - <servicename.namespace.global>
# Treat remote cluster services as part of the service mesh
# as all clusters in the service mesh share the same root of trust.
location: MESH_INTERNAL
ports:
- name: http1
number: 8000
protocol: http
resolution: DNS
addresses:
# the IP address to which httpbin.<namespace>.<logicalcloudname> will resolve to
# must be unique for each remote service, within a given cluster.
# This address need not be routable. Traffic for this IP will be captured
# by the sidecar and routed appropriately.
- 240.0.0.3
endpoints:
# This is the routable address of the istio ingress gateway in cluster02
# routed to this address.
- address: 172.25.55.210
ports:
http1: 15443 //Sni. Do not change this
|
...