Istio Service Mesh

This topic describes Istio Service Mesh and its implementation and versions in HPE Ezmeral Container Platform.

Shifting to a microservice-based architecture delivers numerous benefits for building distributed fault-tolerant applications. However, this approach also introduces many challenges, such as security, network tracing, and traffic routing that are often left to the application developer to code. This approach can lead to inconsistent and fragmented implementation. A service mesh is designed to solve these problems.

A service mesh is a network of microservices that consists of applications and interactions between those applications. Istio provides both a transparent open-source service mesh that overlays onto existing distributed applications and a platform that includes APIs for integration with any logging, telemetry, or policy system.

For a detailed description of Istio features, see What is Istio? (link opens an external website in a new browser tab or window).

To deploy Istio in a Kubernetes cluster in HPE Ezmeral Container Platform, see Deploying Istio Service Mesh. You can enable or disable Istio Service Mesh and enable mTLS for each tenant within the cluster.

To access Kiali visualization for Istio Service Mesh, see Accessing Kiali Visualization for Istio Service Mesh.

Istio Versions

HPE Ezmeral Container Platform includes two implementations of Istio:

  • Kubeflow 1.2, which supports Istio 1.3.1 for managing ingress and egress traffic for Kubeflow components. It also integrates Dex for user authentication and authorization.

  • Standalone Istio, which can be used for Kubernetes clusters EXCEPT the following:

    • A cluster that is or will be running Kubeflow. Do not enable Istio when creating or editing a Kubernetes cluster that will be running Kubeflow, because doing so creates a conflict with the instance of Istio that is included in Kubeflow.
    • An HPE Ezmeral Data Fabric cluster. Do not enable Istio when creating or editing a Data Fabric cluster. Although Istio Service Mesh is suitable for clusters that host compute workloads, Istio Service Mesh is not supported on Data Fabric clusters.

    HPE Ezmeral Container Platform 5.3.1 is deployed with Istio 1.7.1.