Istio without Gateway with nginx-ingress


#1

Hello Everyone,

I use nginx as ingress and are not ready to leave nginx as our nginx does few conditional header manipulation before routing that is not possible with istio’s “virtualService”.

I want to use istio’s traffic routing features such as canary, mirroring, timeout and telemetery features such as prometheus, Jaeger and Graphana and may be few mixer policies but want nginx-ingress as entry point to the cluster and still able to take use of traffic routing.

Can someone guide me on how to achieve this ?

Reagards,
Sourabh


#2

See GH Issue: looking for migration guide from nginx ingress to istio

When deploying nginx-ingress you can add the following pod annotation to tell istio to NOT intercept incoming traffic to nginx-ingress.

    traffic.sidecar.istio.io/includeInboundPorts: ""

Then for outbound traffic you can setup 2 annotations on your Ingress to avoid using endpoints directly and use istio instead.

    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/service-upstream: "true"
    nginx.ingress.kubernetes.io/upstream-vhost: <svc name>.<namespace>.svc.cluster.local

#3

Thanks for your help Dev. I looked into that GH issue you mentioned. I still have few doubts.

First, I am not using “kind: Ingress” object. I am just using an nginx deployment that takes care of TLS termination and call routing.

Second, In “https://github.com/istio/istio/issues/7776#issuecomment-446847610”, He has mentioned he is not able to make use of “virtualservice” when using nginx ast the frontend but is able to make use of “virtualservice” when Gateway is friontend. I am facing the same problem.

If I have to use annotation is someway, can I use them even If I dont use “kind: ingress” object of kubernetes ?


#4

Can someone help with this ?

I want to use nginx in front of pods which will have envoy in them. and i want to use istio’s traffic routing features using “virtualservices”.

I wont be using gateway at all.