[英]Grafana, Prometheus, Kiali authentication with AzureAD and istio internal load balancer
I'm deploying istio in azure kubernetes services (AKS) and I have the following question:我正在 azure kubernetes services (AKS) 中部署 istio,我有以下问题:
Is it possible to deploy istio using an internal load balancer.是否可以使用内部负载均衡器部署 istio。 Looks like it is deployed in Azure with a public load balancer by default.
看起来它默认使用公共负载均衡器部署在 Azure 中。 What do I need to change to make it use an internal load balancer?
我需要更改什么才能使用内部负载平衡器?
To answer the second question :回答第二个问题:
It is possible to add AKS annotation for an internal load balancer according to AKS documentation :根据 AKS文档,可以为内部负载均衡器添加 AKS 注释:
To create an internal load balancer, create a service manifest named
internal-lb.yaml
with the service type LoadBalancer and theazure-load-balancer-internal
annotation as shown in the following example:要创建内部负载均衡器,
internal-lb.yaml
使用服务类型LoadBalancer和azure-load-balancer-internal
注释创建名为internal-lb.yaml
的服务清单,如以下示例所示:apiVersion: v1 kind: Service metadata: name: internal-app annotations: service.beta.kubernetes.io/azure-load-balancer-internal: "true" spec: type: LoadBalancer ports: - port: 80 selector: app: internal-app
So You can set this annotation by using helm with the following --set:因此,您可以使用带有以下 --set 的 helm 来设置此注释:
helm template install/kubernetes/helm/istio --name istio --namespace istio-system --set gateways.istio-ingressgateway.serviceAnnotations.'service\.beta\.kubernetes\.io/azure-load-balancer-internal'="true" > aks-istio.yaml
As mentioned in comment You should stick to One question per post as advised here .正如评论中提到的,您应该按照此处的建议坚持每个帖子一个问题。 So I suggest creating second post with other question.
所以我建议用其他问题创建第二篇文章。
Hope it helps.希望能帮助到你。
Update:更新:
For istioctl You can do the following:对于 istioctl 可以执行以下操作:
istioctl manifest generate --set profile=demo > istio.yaml
istio.yaml
and search for text for type: LoadBalancer
.istio.yaml
并搜索type: LoadBalancer
文本type: LoadBalancer
。---
apiVersion: v1
kind: Service
metadata:
name: istio-ingressgateway
namespace: istio-system
annotations:
labels:
app: istio-ingressgateway
release: istio
istio: ingressgateway
spec:
type: LoadBalancer
selector:
app: istio-ingressgateway
ports:
Add the annotation for the internal load balancer like this:为内部负载均衡器添加注释,如下所示:
---
apiVersion: v1
kind: Service
metadata:
name: istio-ingressgateway
namespace: istio-system
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
labels:
app: istio-ingressgateway
release: istio
istio: ingressgateway
spec:
type: LoadBalancer
selector:
app: istio-ingressgateway
ports:
istio.yaml
to Your K8s cluster using:istio.yaml
部署到您的 K8s 集群:kubectl apply -f istio.yaml
After that You can verify if annotation is present in istio-ingressgateway
service
.之后,您可以验证
istio-ingressgateway
service
是否存在注解。
$ kubectl get svc istio-ingressgateway -n istio-system -o yaml
apiVersion: v1
kind: Service
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","kind":"Service","metadata":{"annotations":{"service.beta.kubernetes.io/azure-load-balancer-internal":"true"},"labels":{"app":"istio-ingressgateway","istio":"ingressgateway","release":"istio"},"name":"istio-ingressgateway","namespace":"istio-system"},"spec":{"ports":[{"name":"status-port","port":15020,"targetPort":15020},{"name":"http2","port":80,"targetPort":80},{"name":"https","port":443},{"name":"kiali","port":15029,"targetPort":15029},{"name":"prometheus","port":15030,"targetPort":15030},{"name":"grafana","port":15031,"targetPort":15031},{"name":"tracing","port":15032,"targetPort":15032},{"name":"tls","port":15443,"targetPort":15443}],"selector":{"app":"istio-ingressgateway"},"type":"LoadBalancer"}}
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
creationTimestamp: "2020-01-27T13:51:07Z"
Hope it helps.希望能帮助到你。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.