github/flagger
1
0
Fork 0
mirror of https://github.com/fluxcd/flagger.git synced 2026-04-15 06:57:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
c9c97c379ddcb7be537aec9c8e609c133ab8aec7
flagger/install/flagger-install-on-google-cloud.html
T
weaveworksbot c9c97c379d Publish website
2020-08-20 06:16:09 +00:00

209 lines
41 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Flagger Install on GKE Istio | Flagger</title>
<meta name="description" content="Progressive Delivery operator for Kubernetes (Canary, A/B Testing and Blue/Green deployments)">
<link rel="icon" href="/favicon.png">
<link rel="stylesheet" href="/website.css">
<meta name="keywords" content="gitops kubernetes flagger istio linkerd appmesh contour gloo nginx">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="Flagger">
<meta name="twitter:description" content="Progressive delivery Kubernetes operator (Canary, A/B Testing and Blue/Green deployments)">
<meta name="twitter:image:src" content="https://flagger.app/flagger-overview.png">
<link rel="preload" href="/assets/css/0.styles.a0ada997.css" as="style"><link rel="preload" href="/assets/js/app.9b46ae46.js" as="script"><link rel="preload" href="/assets/js/2.ba5bf77c.js" as="script"><link rel="preload" href="/assets/js/12.eca4b89c.js" as="script"><link rel="prefetch" href="/assets/js/10.bf6f38d4.js"><link rel="prefetch" href="/assets/js/11.3af38cfe.js"><link rel="prefetch" href="/assets/js/13.9104349a.js"><link rel="prefetch" href="/assets/js/14.a4f3d810.js"><link rel="prefetch" href="/assets/js/15.aada2caa.js"><link rel="prefetch" href="/assets/js/16.3012a10b.js"><link rel="prefetch" href="/assets/js/17.a98b6aa9.js"><link rel="prefetch" href="/assets/js/18.e5188926.js"><link rel="prefetch" href="/assets/js/19.bb9498f7.js"><link rel="prefetch" href="/assets/js/20.2b1bebf5.js"><link rel="prefetch" href="/assets/js/21.e1068843.js"><link rel="prefetch" href="/assets/js/22.1c5d14b9.js"><link rel="prefetch" href="/assets/js/23.b3dcc355.js"><link rel="prefetch" href="/assets/js/24.4f54d289.js"><link rel="prefetch" href="/assets/js/25.914acd1d.js"><link rel="prefetch" href="/assets/js/26.b2d4f402.js"><link rel="prefetch" href="/assets/js/27.ea9f1f9c.js"><link rel="prefetch" href="/assets/js/28.deae273d.js"><link rel="prefetch" href="/assets/js/29.ce4011f4.js"><link rel="prefetch" href="/assets/js/3.8b254d5d.js"><link rel="prefetch" href="/assets/js/30.edda19d9.js"><link rel="prefetch" href="/assets/js/31.fbfb336c.js"><link rel="prefetch" href="/assets/js/32.591c3f2b.js"><link rel="prefetch" href="/assets/js/33.c456709f.js"><link rel="prefetch" href="/assets/js/34.5a071e36.js"><link rel="prefetch" href="/assets/js/35.fc27c09e.js"><link rel="prefetch" href="/assets/js/36.144098aa.js"><link rel="prefetch" href="/assets/js/4.26a3069c.js"><link rel="prefetch" href="/assets/js/5.0c32bdf9.js"><link rel="prefetch" href="/assets/js/6.ee5ffca3.js"><link rel="prefetch" href="/assets/js/7.6bf27a87.js"><link rel="prefetch" href="/assets/js/8.8b72a8d3.js"><link rel="prefetch" href="/assets/js/9.7919fc1d.js">
<link rel="stylesheet" href="/assets/css/0.styles.a0ada997.css">
</head>
<body>
<div id="app" data-server-rendered="true"><div class="theme-container"><header class="navbar"><div class="sidebar-button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" role="img" viewBox="0 0 448 512" class="icon"><path fill="currentColor" d="M436 124H12c-6.627 0-12-5.373-12-12V80c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12z"></path></svg></div> <a href="/" class="home-link router-link-active"><!----> <span class="site-name">Flagger</span></a> <div class="links"><div class="search-box"><input aria-label="Search" autocomplete="off" spellcheck="false" value=""> <!----></div> <nav class="nav-links can-hide"><div class="nav-item"><a href="https://docs.flagger.app" target="_blank" rel="noopener noreferrer" class="nav-link external">
Docs
<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></div><div class="nav-item"><a href="https://github.com/weaveworks/flagger/blob/master/CHANGELOG.md" target="_blank" rel="noopener noreferrer" class="nav-link external">
Changelog
<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></div> <a href="https://github.com/weaveworks/flagger" target="_blank" rel="noopener noreferrer" class="repo-link">
GitHub
<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></nav></div></header> <div class="sidebar-mask"></div> <aside class="sidebar"><nav class="nav-links"><div class="nav-item"><a href="https://docs.flagger.app" target="_blank" rel="noopener noreferrer" class="nav-link external">
Docs
<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></div><div class="nav-item"><a href="https://github.com/weaveworks/flagger/blob/master/CHANGELOG.md" target="_blank" rel="noopener noreferrer" class="nav-link external">
Changelog
<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></div> <a href="https://github.com/weaveworks/flagger" target="_blank" rel="noopener noreferrer" class="repo-link">
GitHub
<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></nav> <ul class="sidebar-links"><li><a href="/" class="sidebar-link">Home</a></li><li><section class="sidebar-group depth-0"><a href="/intro/" class="sidebar-heading clickable"><span>Introduction</span> <!----></a> <ul class="sidebar-links sidebar-group-items"><li><a href="/intro/" class="sidebar-link">Get Started</a></li><li><a href="/intro/faq.html" class="sidebar-link">FAQ</a></li></ul></section></li><li><section class="sidebar-group depth-0"><a href="/install/flagger-install-on-kubernetes" class="sidebar-heading clickable open"><span>Install</span> <!----></a> <ul class="sidebar-links sidebar-group-items"><li><a href="/install/flagger-install-on-kubernetes.html" class="sidebar-link">On Kubernetes</a></li><li><a href="/install/flagger-install-on-google-cloud.html" class="active sidebar-link">On GKE Istio</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#prerequisites" class="sidebar-link">Prerequisites</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#gke-cluster-setup" class="sidebar-link">GKE cluster setup</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#cloud-dns-setup" class="sidebar-link">Cloud DNS setup</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#install-helm" class="sidebar-link">Install Helm</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#install-cert-manager" class="sidebar-link">Install cert-manager</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#istio-gateway-tls-setup" class="sidebar-link">Istio Gateway TLS setup</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#install-prometheus" class="sidebar-link">Install Prometheus</a></li><li class="sidebar-sub-header"><a href="/install/flagger-install-on-google-cloud.html#install-flagger-and-grafana" class="sidebar-link">Install Flagger and Grafana</a></li></ul></li><li><a href="/install/flagger-install-on-eks-appmesh.html" class="sidebar-link">On EKS App Mesh</a></li></ul></section></li><li><section class="sidebar-group depth-0"><a href="/usage/how-it-works" class="sidebar-heading clickable"><span>Usage</span> <!----></a> <ul class="sidebar-links sidebar-group-items"><li><a href="/usage/how-it-works.html" class="sidebar-link">How it works</a></li><li><a href="/usage/deployment-strategies.html" class="sidebar-link">Deployment Strategies</a></li><li><a href="/usage/metrics.html" class="sidebar-link">Metrics Analysis</a></li><li><a href="/usage/webhooks.html" class="sidebar-link">Webhooks</a></li><li><a href="/usage/alerting.html" class="sidebar-link">Alerting</a></li><li><a href="/usage/monitoring.html" class="sidebar-link">Monitoring</a></li></ul></section></li><li><section class="sidebar-group depth-0"><a href="/tutorials/istio-progressive-delivery" class="sidebar-heading clickable"><span>Tutorials</span> <!----></a> <ul class="sidebar-links sidebar-group-items"><li><a href="/tutorials/istio-progressive-delivery.html" class="sidebar-link">Istio Canaries</a></li><li><a href="/tutorials/istio-ab-testing.html" class="sidebar-link">Istio A/B Testing</a></li><li><a href="/tutorials/linkerd-progressive-delivery.html" class="sidebar-link">Linkerd Canaries</a></li><li><a href="/tutorials/appmesh-progressive-delivery.html" class="sidebar-link">App Mesh Canaries</a></li><li><a href="/tutorials/nginx-progressive-delivery.html" class="sidebar-link">NGINX Ingress Canaries</a></li><li><a href="/tutorials/gloo-progressive-delivery.html" class="sidebar-link">Gloo Canaries</a></li><li><a href="/tutorials/contour-progressive-delivery.html" class="sidebar-link">Contour Canaries</a></li><li><a href="/tutorials/kubernetes-blue-green.html" class="sidebar-link">Kubernetes Blue/Green</a></li><li><a href="/tutorials/canary-helm-gitops.html" class="sidebar-link">Canaries with Helm charts and GitOps</a></li></ul></section></li><li><section class="sidebar-group depth-0"><a href="/dev/dev-guide" class="sidebar-heading clickable"><span>Dev</span> <!----></a> <ul class="sidebar-links sidebar-group-items"><li><a href="/dev/dev-guide.html" class="sidebar-link">Development Guide</a></li><li><a href="/dev/release-guide.html" class="sidebar-link">Release Guide</a></li><li><a href="/dev/upgrade-guide.html" class="sidebar-link">Upgrade Guide</a></li></ul></section></li></ul> </aside> <main class="page"> <div class="theme-default-content content__default"><h1 id="flagger-install-on-gke-istio"><a href="#flagger-install-on-gke-istio" aria-hidden="true" class="header-anchor">#</a> Flagger Install on GKE Istio</h1> <p>This guide walks you through setting up Flagger and Istio on Google Kubernetes Engine.</p> <p><img src="https://raw.githubusercontent.com/weaveworks/flagger/master/docs/diagrams/flagger-gke-istio.png" alt="GKE Cluster Overview"></p> <h2 id="prerequisites"><a href="#prerequisites" aria-hidden="true" class="header-anchor">#</a> Prerequisites</h2> <p>You will be creating a cluster on Google’s Kubernetes Engine (GKE), if you don’t have an account you can sign up <a href="https://cloud.google.com/free/" target="_blank" rel="noopener noreferrer">here<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a> for free credits.</p> <p>Login into Google Cloud, create a project and enable billing for it.</p> <p>Install the <a href="https://cloud.google.com/sdk/" target="_blank" rel="noopener noreferrer">gcloud<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a> command line utility and configure your project with <code>gcloud init</code>.</p> <p>Set the default project (replace <code>PROJECT_ID</code> with your own project):</p> <div class="language-text extra-class"><pre class="language-text"><code>gcloud config set project PROJECT_ID
</code></pre></div><p>Set the default compute region and zone:</p> <div class="language-text extra-class"><pre class="language-text"><code>gcloud config set compute/region us-central1
gcloud config set compute/zone us-central1-a
</code></pre></div><p>Enable the Kubernetes and Cloud DNS services for your project:</p> <div class="language-text extra-class"><pre class="language-text"><code>gcloud services enable container.googleapis.com
gcloud services enable dns.googleapis.com
</code></pre></div><p>Install the kubectl command-line tool:</p> <div class="language-text extra-class"><pre class="language-text"><code>gcloud components install kubectl
</code></pre></div><h2 id="gke-cluster-setup"><a href="#gke-cluster-setup" aria-hidden="true" class="header-anchor">#</a> GKE cluster setup</h2> <p>Create a cluster with the Istio add-on:</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token assign-left variable">K8S_VERSION</span><span class="token operator">=</span><span class="token variable"><span class="token variable">$(</span>gcloud container get-server-config --format<span class="token operator">=</span>json <span class="token punctuation">\</span>
<span class="token operator">|</span> jq -r <span class="token string">'.validMasterVersions[0]'</span><span class="token variable">)</span></span>
gcloud beta container clusters create istio <span class="token punctuation">\</span>
--cluster-version<span class="token operator">=</span><span class="token variable">${K8S_VERSION}</span> <span class="token punctuation">\</span>
--zone<span class="token operator">=</span>us-central1-a <span class="token punctuation">\</span>
--num-nodes<span class="token operator">=</span><span class="token number">2</span> <span class="token punctuation">\</span>
--machine-type<span class="token operator">=</span>n1-highcpu-4 <span class="token punctuation">\</span>
--preemptible <span class="token punctuation">\</span>
--no-enable-cloud-logging <span class="token punctuation">\</span>
--no-enable-cloud-monitoring <span class="token punctuation">\</span>
--disk-size<span class="token operator">=</span><span class="token number">30</span> <span class="token punctuation">\</span>
--enable-autorepair <span class="token punctuation">\</span>
--addons<span class="token operator">=</span>HorizontalPodAutoscaling,Istio <span class="token punctuation">\</span>
--istio-config<span class="token operator">=</span>auth<span class="token operator">=</span>MTLS_PERMISSIVE
</code></pre></div><p>The above command will create a default node pool consisting of two <code>n1-highcpu-4</code> (vCPU: 4, RAM 3.60GB, DISK: 30GB) preemptible VMs. Preemptible VMs are up to 80% cheaper than regular instances and are terminated and replaced after a maximum of 24 hours.</p> <p>Set up credentials for <code>kubectl</code>:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>gcloud container clusters get-credentials istio
</code></pre></div><p>Create a cluster admin role binding:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl create clusterrolebinding <span class="token string">&quot;cluster-admin-<span class="token variable"><span class="token variable">$(</span><span class="token function">whoami</span><span class="token variable">)</span></span>&quot;</span> <span class="token punctuation">\</span>
--clusterrole<span class="token operator">=</span>cluster-admin <span class="token punctuation">\</span>
--user<span class="token operator">=</span><span class="token string">&quot;<span class="token variable"><span class="token variable">$(</span>gcloud config get-value core/account<span class="token variable">)</span></span>&quot;</span>
</code></pre></div><p>Validate your setup with:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl -n istio-system get svc
</code></pre></div><p>In a couple of seconds GCP should allocate an external IP to the <code>istio-ingressgateway</code> service.</p> <h2 id="cloud-dns-setup"><a href="#cloud-dns-setup" aria-hidden="true" class="header-anchor">#</a> Cloud DNS setup</h2> <p>You will need an internet domain and access to the registrar to change the name servers to Google Cloud DNS.</p> <p>Create a managed zone named <code>istio</code> in Cloud DNS (replace <code>example.com</code> with your domain):</p> <div class="language-bash extra-class"><pre class="language-bash"><code>gcloud dns managed-zones create <span class="token punctuation">\</span>
--dns-name<span class="token operator">=</span><span class="token string">&quot;example.com.&quot;</span> <span class="token punctuation">\</span>
--description<span class="token operator">=</span><span class="token string">&quot;Istio zone&quot;</span> <span class="token string">&quot;istio&quot;</span>
</code></pre></div><p>Look up your zone's name servers:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>gcloud dns managed-zones describe istio
</code></pre></div><p>Update your registrar's name server records with the records returned by the above command.</p> <p>Wait for the name servers to change (replace <code>example.com</code> with your domain):</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token function">watch</span> <span class="token function">dig</span> +short NS example.com
</code></pre></div><p>Create a static IP address named <code>istio-gateway</code> using the Istio ingress IP:</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token builtin class-name">export</span> <span class="token assign-left variable">GATEWAY_IP</span><span class="token operator">=</span><span class="token variable"><span class="token variable">$(</span>kubectl -n istio-system get svc/istio-ingressgateway -ojson <span class="token punctuation">\</span>
<span class="token operator">|</span> jq -r .status.loadBalancer.ingress<span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span>.ip<span class="token variable">)</span></span>
gcloud compute addresses create istio-gateway --addresses <span class="token variable">${GATEWAY_IP}</span> --region us-central1
</code></pre></div><p>Create the following DNS records (replace <code>example.com</code> with your domain):</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token assign-left variable">DOMAIN</span><span class="token operator">=</span><span class="token string">&quot;example.com&quot;</span>
gcloud dns record-sets transaction start --zone<span class="token operator">=</span>istio
gcloud dns record-sets transaction <span class="token function">add</span> --zone<span class="token operator">=</span>istio <span class="token punctuation">\</span>
--name<span class="token operator">=</span><span class="token string">&quot;<span class="token variable">${DOMAIN}</span>&quot;</span> --ttl<span class="token operator">=</span><span class="token number">300</span> --type<span class="token operator">=</span>A <span class="token variable">${GATEWAY_IP}</span>
gcloud dns record-sets transaction <span class="token function">add</span> --zone<span class="token operator">=</span>istio <span class="token punctuation">\</span>
--name<span class="token operator">=</span><span class="token string">&quot;www.<span class="token variable">${DOMAIN}</span>&quot;</span> --ttl<span class="token operator">=</span><span class="token number">300</span> --type<span class="token operator">=</span>A <span class="token variable">${GATEWAY_IP}</span>
gcloud dns record-sets transaction <span class="token function">add</span> --zone<span class="token operator">=</span>istio <span class="token punctuation">\</span>
--name<span class="token operator">=</span><span class="token string">&quot;*.<span class="token variable">${DOMAIN}</span>&quot;</span> --ttl<span class="token operator">=</span><span class="token number">300</span> --type<span class="token operator">=</span>A <span class="token variable">${GATEWAY_IP}</span>
gcloud dns record-sets transaction execute --zone istio
</code></pre></div><p>Verify that the wildcard DNS is working (replace <code>example.com</code> with your domain):</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token function">watch</span> <span class="token function">host</span> test.example.com
</code></pre></div><h2 id="install-helm"><a href="#install-helm" aria-hidden="true" class="header-anchor">#</a> Install Helm</h2> <p>Install the <a href="https://docs.helm.sh/using_helm/#installing-helm" target="_blank" rel="noopener noreferrer">Helm<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a> command-line tool:</p> <div class="language-text extra-class"><pre class="language-text"><code>brew install kubernetes-helm
</code></pre></div><p>Create a service account and a cluster role binding for Tiller:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl -n kube-system create sa tiller
kubectl create clusterrolebinding tiller-cluster-rule <span class="token punctuation">\</span>
--clusterrole<span class="token operator">=</span>cluster-admin <span class="token punctuation">\</span>
--serviceaccount<span class="token operator">=</span>kube-system:tiller
</code></pre></div><p>Deploy Tiller in the <code>kube-system</code> namespace:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>helm init --service-account tiller
</code></pre></div><p>You should consider using SSL between Helm and Tiller, for more information on securing your Helm installation see <a href="https://docs.helm.sh/using_helm/#securing-your-helm-installation" target="_blank" rel="noopener noreferrer">docs.helm.sh<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a>.</p> <h2 id="install-cert-manager"><a href="#install-cert-manager" aria-hidden="true" class="header-anchor">#</a> Install cert-manager</h2> <p>Jetstack's <a href="https://github.com/jetstack/cert-manager" target="_blank" rel="noopener noreferrer">cert-manager<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a> is a Kubernetes operator that automatically creates and manages TLS certs issued by Let’s Encrypt.</p> <p>You'll be using cert-manager to provision a wildcard certificate for the Istio ingress gateway.</p> <p>Install cert-manager's CRDs:</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token assign-left variable">CERT_REPO</span><span class="token operator">=</span>https://raw.githubusercontent.com/jetstack/cert-manager
kubectl apply -f <span class="token variable">${CERT_REPO}</span>/release-0.10/deploy/manifests/00-crds.yaml
</code></pre></div><p>Create the cert-manager namespace and disable resource validation:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl create namespace cert-manager
kubectl label namespace cert-manager certmanager.k8s.io/disable-validation<span class="token operator">=</span>true
</code></pre></div><p>Install cert-manager with Helm:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>helm repo <span class="token function">add</span> jetstack https://charts.jetstack.io <span class="token operator">&amp;&amp;</span> <span class="token punctuation">\</span>
helm repo update <span class="token operator">&amp;&amp;</span> <span class="token punctuation">\</span>
helm upgrade -i cert-manager <span class="token punctuation">\</span>
--namespace cert-manager <span class="token punctuation">\</span>
--version v0.10.0 <span class="token punctuation">\</span>
jetstack/cert-manager
</code></pre></div><h2 id="istio-gateway-tls-setup"><a href="#istio-gateway-tls-setup" aria-hidden="true" class="header-anchor">#</a> Istio Gateway TLS setup</h2> <p><img src="https://raw.githubusercontent.com/weaveworks/flagger/master/docs/diagrams/istio-cert-manager-gke.png" alt="Istio Let's Encrypt"></p> <p>Create a generic Istio Gateway to expose services outside the mesh on HTTPS:</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token assign-left variable">REPO</span><span class="token operator">=</span>https://raw.githubusercontent.com/weaveworks/flagger/master
kubectl apply -f <span class="token variable">${REPO}</span>/artifacts/gke/istio-gateway.yaml
</code></pre></div><p>Create a service account with Cloud DNS admin role (replace <code>my-gcp-project</code> with your project ID):</p> <div class="language-bash extra-class"><pre class="language-bash"><code><span class="token assign-left variable">GCP_PROJECT</span><span class="token operator">=</span>my-gcp-project
gcloud iam service-accounts create dns-admin <span class="token punctuation">\</span>
--display-name<span class="token operator">=</span>dns-admin <span class="token punctuation">\</span>
--project<span class="token operator">=</span><span class="token variable">${GCP_PROJECT}</span>
gcloud iam service-accounts keys create ./gcp-dns-admin.json <span class="token punctuation">\</span>
--iam-account<span class="token operator">=</span>dns-admin@<span class="token variable">${GCP_PROJECT}</span>.iam.gserviceaccount.com <span class="token punctuation">\</span>
--project<span class="token operator">=</span><span class="token variable">${GCP_PROJECT}</span>
gcloud projects add-iam-policy-binding <span class="token variable">${GCP_PROJECT}</span> <span class="token punctuation">\</span>
--member<span class="token operator">=</span>serviceAccount:dns-admin@<span class="token variable">${GCP_PROJECT}</span>.iam.gserviceaccount.com <span class="token punctuation">\</span>
--role<span class="token operator">=</span>roles/dns.admin
</code></pre></div><p>Create a Kubernetes secret with the GCP Cloud DNS admin key:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl create secret generic cert-manager-credentials <span class="token punctuation">\</span>
--from-file<span class="token operator">=</span>./gcp-dns-admin.json <span class="token punctuation">\</span>
--namespace<span class="token operator">=</span>istio-system
</code></pre></div><p>Create a letsencrypt issuer for CloudDNS (replace <code>email@example.com</code> with a valid email address and <code>my-gcp-project</code>with your project ID):</p> <div class="language-yaml extra-class"><pre class="language-yaml"><code><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> certmanager.k8s.io/v1alpha1
<span class="token key atrule">kind</span><span class="token punctuation">:</span> Issuer
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> letsencrypt<span class="token punctuation">-</span>prod
<span class="token key atrule">namespace</span><span class="token punctuation">:</span> istio<span class="token punctuation">-</span>system
<span class="token key atrule">spec</span><span class="token punctuation">:</span>
<span class="token key atrule">acme</span><span class="token punctuation">:</span>
<span class="token key atrule">server</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//acme<span class="token punctuation">-</span>v02.api.letsencrypt.org/directory
<span class="token key atrule">email</span><span class="token punctuation">:</span> email@example.com
<span class="token key atrule">privateKeySecretRef</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> letsencrypt<span class="token punctuation">-</span>prod
<span class="token key atrule">dns01</span><span class="token punctuation">:</span>
<span class="token key atrule">providers</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> cloud<span class="token punctuation">-</span>dns
<span class="token key atrule">clouddns</span><span class="token punctuation">:</span>
<span class="token key atrule">serviceAccountSecretRef</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> cert<span class="token punctuation">-</span>manager<span class="token punctuation">-</span>credentials
<span class="token key atrule">key</span><span class="token punctuation">:</span> gcp<span class="token punctuation">-</span>dns<span class="token punctuation">-</span>admin.json
<span class="token key atrule">project</span><span class="token punctuation">:</span> my<span class="token punctuation">-</span>gcp<span class="token punctuation">-</span>project
</code></pre></div><p>Save the above resource as letsencrypt-issuer.yaml and then apply it:</p> <div class="language-text extra-class"><pre class="language-text"><code>kubectl apply -f ./letsencrypt-issuer.yaml
</code></pre></div><p>Create a wildcard certificate (replace <code>example.com</code> with your domain):</p> <div class="language-yaml extra-class"><pre class="language-yaml"><code><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> certmanager.k8s.io/v1alpha1
<span class="token key atrule">kind</span><span class="token punctuation">:</span> Certificate
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> istio<span class="token punctuation">-</span>gateway
<span class="token key atrule">namespace</span><span class="token punctuation">:</span> istio<span class="token punctuation">-</span>system
<span class="token key atrule">spec</span><span class="token punctuation">:</span>
<span class="token key atrule">secretName</span><span class="token punctuation">:</span> istio<span class="token punctuation">-</span>ingressgateway<span class="token punctuation">-</span>certs
<span class="token key atrule">issuerRef</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> letsencrypt<span class="token punctuation">-</span>prod
<span class="token key atrule">commonName</span><span class="token punctuation">:</span> <span class="token string">&quot;*.example.com&quot;</span>
<span class="token key atrule">acme</span><span class="token punctuation">:</span>
<span class="token key atrule">config</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">dns01</span><span class="token punctuation">:</span>
<span class="token key atrule">provider</span><span class="token punctuation">:</span> cloud<span class="token punctuation">-</span>dns
<span class="token key atrule">domains</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token string">&quot;*.example.com&quot;</span>
<span class="token punctuation">-</span> <span class="token string">&quot;example.com&quot;</span>
</code></pre></div><p>Save the above resource as istio-gateway-cert.yaml and then apply it:</p> <div class="language-text extra-class"><pre class="language-text"><code>kubectl apply -f ./istio-gateway-cert.yaml
</code></pre></div><p>In a couple of seconds cert-manager should fetch a wildcard certificate from letsencrypt.org:</p> <div class="language-text extra-class"><pre class="language-text"><code>kubectl -n istio-system describe certificate istio-gateway
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal CertIssued 1m52s cert-manager Certificate issued successfully
</code></pre></div><p>Recreate Istio ingress gateway pods:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl -n istio-system get pods -l <span class="token assign-left variable">istio</span><span class="token operator">=</span>ingressgateway
</code></pre></div><p>Note that Istio gateway doesn't reload the certificates from the TLS secret on cert-manager renewal. Since the GKE cluster is made out of preemptible VMs the gateway pods will be replaced once every 24h, if your not using preemptible nodes then you need to manually delete the gateway pods every two months before the certificate expires.</p> <h2 id="install-prometheus"><a href="#install-prometheus" aria-hidden="true" class="header-anchor">#</a> Install Prometheus</h2> <p>The GKE Istio add-on does not include a Prometheus instance that scrapes the Istio telemetry service. Because Flagger uses the Istio HTTP metrics to run the canary analysis you have to deploy the following Prometheus configuration that's similar to the one that comes with the official Istio Helm chart.</p> <p>Find the GKE Istio version with:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl -n istio-system get deploy istio-pilot -oyaml <span class="token operator">|</span> <span class="token function">grep</span> image:
</code></pre></div><p>Install Prometheus in istio-system namespace:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl -n istio-system apply -f <span class="token punctuation">\</span>
https://storage.googleapis.com/gke-release/istio/release/1.0.6-gke.3/patches/install-prometheus.yaml
</code></pre></div><h2 id="install-flagger-and-grafana"><a href="#install-flagger-and-grafana" aria-hidden="true" class="header-anchor">#</a> Install Flagger and Grafana</h2> <p>Add Flagger Helm repository:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>helm repo <span class="token function">add</span> flagger https://flagger.app
</code></pre></div><p>Install Flagger's Canary CRD:</p> <div class="language-yaml extra-class"><pre class="language-yaml"><code>kubectl apply <span class="token punctuation">-</span>f https<span class="token punctuation">:</span>//raw.githubusercontent.com/weaveworks/flagger/master/artifacts/flagger/crd.yaml
</code></pre></div><p>Deploy Flagger in the <code>istio-system</code> namespace with Slack notifications enabled:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>helm upgrade -i flagger flagger/flagger <span class="token punctuation">\</span>
--namespace<span class="token operator">=</span>istio-system <span class="token punctuation">\</span>
--set crd.create<span class="token operator">=</span>false <span class="token punctuation">\</span>
--set <span class="token assign-left variable">metricsServer</span><span class="token operator">=</span>http://prometheus.istio-system:9090 <span class="token punctuation">\</span>
--set slack.url<span class="token operator">=</span>https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK <span class="token punctuation">\</span>
--set slack.channel<span class="token operator">=</span>general <span class="token punctuation">\</span>
--set slack.user<span class="token operator">=</span>flagger
</code></pre></div><p>Deploy Grafana in the <code>istio-system</code> namespace:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>helm upgrade -i flagger-grafana flagger/grafana <span class="token punctuation">\</span>
--namespace<span class="token operator">=</span>istio-system <span class="token punctuation">\</span>
--set <span class="token assign-left variable">url</span><span class="token operator">=</span>http://prometheus.istio-system:9090 <span class="token punctuation">\</span>
--set <span class="token assign-left variable">user</span><span class="token operator">=</span>admin <span class="token punctuation">\</span>
--set <span class="token assign-left variable">password</span><span class="token operator">=</span>replace-me
</code></pre></div><p>Expose Grafana through the public gateway by creating a virtual service (replace <code>example.com</code> with your domain):</p> <div class="language-yaml extra-class"><pre class="language-yaml"><code><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> networking.istio.io/v1alpha3
<span class="token key atrule">kind</span><span class="token punctuation">:</span> VirtualService
<span class="token key atrule">metadata</span><span class="token punctuation">:</span>
<span class="token key atrule">name</span><span class="token punctuation">:</span> grafana
<span class="token key atrule">namespace</span><span class="token punctuation">:</span> istio<span class="token punctuation">-</span>system
<span class="token key atrule">spec</span><span class="token punctuation">:</span>
<span class="token key atrule">hosts</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token string">&quot;grafana.example.com&quot;</span>
<span class="token key atrule">gateways</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> public<span class="token punctuation">-</span>gateway.istio<span class="token punctuation">-</span>system.svc.cluster.local
<span class="token key atrule">http</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">route</span><span class="token punctuation">:</span>
<span class="token punctuation">-</span> <span class="token key atrule">destination</span><span class="token punctuation">:</span>
<span class="token key atrule">host</span><span class="token punctuation">:</span> flagger<span class="token punctuation">-</span>grafana
</code></pre></div><p>Save the above resource as grafana-virtual-service.yaml and then apply it:</p> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl apply -f ./grafana-virtual-service.yaml
</code></pre></div><p>Navigate to <code>http://grafana.example.com</code> in your browser and you should be redirected to the HTTPS version.</p></div> <footer class="page-edit"><!----> <!----></footer> <div class="page-nav"><p class="inner"><span class="prev">
←
<a href="/install/flagger-install-on-kubernetes.html" class="prev">
On Kubernetes
</a></span> <span class="next"><a href="/install/flagger-install-on-eks-appmesh.html">
On EKS App Mesh
</a>
→
</span></p></div> </main></div><div class="global-ui"></div></div>
<script src="/assets/js/app.9b46ae46.js" defer></script><script src="/assets/js/2.ba5bf77c.js" defer></script><script src="/assets/js/12.eca4b89c.js" defer></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink