Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

Chapter 2. Getting traffic into a mesh

Using Istio APIs, you can configure gateway proxies that were installed using gateway injection to accept traffic originating from outside the mesh, and route that traffic to the services within the mesh.

You can expose gateway proxies to traffic outside a cluster by using either a LoadBalancer type Service or OpenShift Routes.

2.1. About ingress traffic routing approaches
Copia collegamento

Red Hat OpenShift Service Mesh offers two approaches to configure ingress traffic routing to services in the mesh. The approach depends on the service mesh deployment mode and traffic management requirements.

Ingress routing with gateway injection and Istio APIs
When you install a gateway by using gateway injection, you can configure it to receive ingress traffic by using the Istio Gateway and VirtualService resources in combination.

The gateway injection approach is compatible with sidecar-based service mesh deployments where you enable sidecar injection in namespaces by using the istio-injection=enabled label or the istio.io/rev=<revision> label.

Ingress routing with Kubernetes Gateway API
The Kubernetes Gateway API provides a standardized approach for configuring ingress traffic routing using native Kubernetes resources. With this approach, you use Gateway and HTTPRoute (or GRPCRoute) resources to configure how traffic enters the mesh and routes to services.

While Istio Gateway and VirtualService resources can be used for certain ingress use cases in ambient mode, the recommended approach is to use the Kubernetes Gateway API, which provides full support and integration with ambient. You can also use the Gateway API with sidecar-based deployments.

You can use the Istio Gateway and VirtualService resources to configure a gateway that was deployed by using gateway injection. The resources expose a service in the mesh to traffic outside the mesh. You can set the gateway Service type to LoadBalancer to allow traffic from outside the cluster.

Prerequisites

  • You have installed Istio gateways using gateway injection.
  • You are using the Istio Gateway and VirtualService resources.
  • You have existing VirtualService configurations and do not plan on migrating to ambient mode.

Procedure

  1. Create namespace called httpbin by running the following command: 

    $ oc create namespace httpbin
    Copy to Clipboard Toggle word wrap

  2. Enable sidecar injection in the namespace. If you are using the InPlace upgrade strategy, run the following command: 

    $ oc label namespace httpbin istio-injection=enabled
    Copy to Clipboard Toggle word wrap
    Note

    If you are using the RevisionBased upgrade strategy, run the following commands:

    1. To find your <revision-name>, run the following command: 

      $ oc get istiorevisions.sailoperator.io
      Copy to Clipboard Toggle word wrap

      You will get an output similar to the following example: 

    NAME      TYPE    READY   STATUS    IN USE   VERSION   AGE
default   Local   True    Healthy   True    v1.24.3   3m33s
    Copy to Clipboard Toggle word wrap

    1. Label the namespace with the revision name to enable sidecar injection: 

      $ oc label namespace httpbin istio.io/rev=default
      Copy to Clipboard Toggle word wrap

  3. Deploy a sample service named httpbin by running the following command: 

    $ oc apply -n httpbin -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml
    Copy to Clipboard Toggle word wrap

  4. Create a YAML file named httpbin-gw.yaml that defines an Istio Gateway resource. This resource configures gateway proxies to expose port 80 (HTTP) for the host, httpbin.example.com. 

    apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: httpbin-gateway
  namespace: httpbin
spec:
  selector:
    istio: <gateway_name>
    1 
    
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - httpbin.example.com
    2
    Copy to Clipboard Toggle word wrap
    1
    Set the selector to the unique label or set of labels specified in the pod template of the gateway proxy Deployment. By default, the Istio Gateway resource configuration will apply to matching gateway pods in all namespaces.
    2
    Using the hosts field, specify a list of addresses that can be used by clients when attempting to access a mesh service at the associated port.

  5. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-gw.yaml
    Copy to Clipboard Toggle word wrap

  6. Create a YAML file named httpbin-vs.yaml for a VirtualService. The VirtualService defines the rules that route traffic from the gateway proxy to the httpbin service. 

    apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin
  namespace: httpbin
spec:
  hosts:
  - httpbin.example.com
    1 
    
  gateways:
  - httpbin-gateway
    2 
    
  http:
  - match:
    - uri:
        prefix: /status
    - uri:
        prefix: /headers
    route:
    - destination:
    3 
    
        port:
          number: 8000
        host: httpbin
    Copy to Clipboard Toggle word wrap
    1
    Specify the hosts that the routing rules of the VirtualService will be applied to. The hosts specified must be exposed by the Istio Gateway resource the VirtualService is bound to.
    2
    Bind the VirtualService to the Istio Gateway resource created in the previous step by adding the Gateway name to the list of gateways.
    3
    Route matching traffic to the httpbin service deployed earlier by defining a destination that includes the host and port of the httpbin Service.

  7. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-vs.yaml
    Copy to Clipboard Toggle word wrap

  8. For verification purposes, create a namespace for a curl client by running the following command: 

    $ oc create namespace curl
    Copy to Clipboard Toggle word wrap

  9. Deploy the curl client by running the following command: 

    $ oc apply -n curl -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml
    Copy to Clipboard Toggle word wrap

  10. Set a CURL_POD variable with the name of the curl pod by running the following command: 

    $ CURL_POD=$(oc get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')
    Copy to Clipboard Toggle word wrap

  11. Using the curl client, send a request to the /headers endpoint of the httpbin application through the ingress gateway Service resource. Set the Host header of the request to httpbin.example.com to match the host that the Istio Gateway and VirtualService resources specify. Run the following curl command to send the request: 

    $ oc exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    <gateway_name>.<gateway_namespace>.svc.cluster.local/headers
    Copy to Clipboard Toggle word wrap

  12. The response should have a 200 OK HTTP status indicating that the request was successful. 

    HTTP/1.1 200 OK
server: istio-envoy
...
    Copy to Clipboard Toggle word wrap

  13. Send a curl request to an endpoint that does not have a corresponding URI prefix match defined in the httpbin VirtualService by running the following command: 

    $ oc exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    <gateway_name>.<gateway_namespace>.svc.cluster.local/get
    Copy to Clipboard Toggle word wrap

    The response should return a 404 Not Found status. This is expected because the /get endpoint does not have a matching URI prefix in the httpbin VirtualService resource. 

    HTTP/1.1 404 Not Found
server: istio-envoy
...
    Copy to Clipboard Toggle word wrap

  14. Expose the gateway proxy to traffic outside the cluster by setting the Service type to LoadBalancer: 

    $ oc patch service <gateway_name> -n <gateway_namespace> -p '{"spec": {"type": "LoadBalancer"}}'
    Copy to Clipboard Toggle word wrap
    Note

    A gateway can also be exposed to traffic outside the cluster by using OpenShift Routes. For more information, see "Exposing a gateway to traffic outside the cluster using OpenShift Routes".

  15. Verify that httpbin service can be accessed from outside the cluster when using the external hostname or IP address of the gateway Service resource. Ensure that you set the INGRESS_HOST variable appropriately for the environment that your cluster is running in.

    1. If the cluster runs on AWS, set the INGRESS_HOST variable by running the following command: 

      $ INGRESS_HOST=$(oc get service <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
      Copy to Clipboard Toggle word wrap

    2. If the cluster runs on GCP or Azure, set the INGRESS_HOST variable by running the following command: 

      $ INGRESS_HOST=$(oc get service <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
      Copy to Clipboard Toggle word wrap

    3. Send a curl request to the httpbin service using the host of the gateway by running the following command: 

      $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST/headers
      Copy to Clipboard Toggle word wrap
  16. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.

2.3. About exposing services to traffic outside a cluster
Copia collegamento

To enable traffic from outside an OpenShift cluster to access services in a mesh, you must expose a gateway proxy by either setting its Service type to LoadBalancer or by using the OpenShift Router.

Using Kubernetes load balancing to handle incoming traffic directly through the inbound gateway can reduce latency associated with data encryption. By managing encryption at the inbound gateway, you avoid the intermediate decryption and re-encryption steps within the mesh that often add latency. This approach allows mesh traffic to be encrypted and decrypted only once, which is generally more efficient.

The OpenShift Router provides a standard approach for managing ingress traffic, and you can use the router to manage certificates for all cluster ingress traffic using the same methods. However, the OpenShift Router introduces an additional hop between the inbound traffic and the mesh applications. Typically, you route the traffic by decrypting it at the router and then re-encrypting it at the service mesh ingress gateway, which introduces latency.

You can expose a gateway to traffic outside the cluster by using OpenShift Routes. This approach provides an alternative to using Kubernetes load balancer service when you have to expose gateways to traffic outside the cluster.

Prerequisites

  • You have completed the procedure, Exposing a Service by using the Istio Gateway and VirtualService resources.

Procedure

  1. Ensure that the Service type is set to ClusterIP by running the following command: 

    $ oc patch service <gateway_name> -n <gateway_namespace> -p '{"spec": {"type": "ClusterIP"}}'
    Copy to Clipboard Toggle word wrap

  2. Create a YAML file named httpbin-route.yaml that defines a Route for the httpbin service. 

    apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: httpbin
  namespace: <gateway_namespace>
spec:
  host: httpbin.example.com
  port:
    targetPort: http2
  to:
    kind: Service
    name: <gateway_name>
    weight: 100
  wildcardPolicy: None
    Copy to Clipboard Toggle word wrap

  3. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-route.yaml
    Copy to Clipboard Toggle word wrap

  4. Verify that httpbin service can be accessed from outside the cluster through the ingress router. Ensure that you set the INGRESS_HOST variable appropriately for the environment that your cluster is running in.

    1. If the cluster runs on AWS, set the INGRESS_HOST variable by running the following command: 

      $ INGRESS_HOST=$(oc get service router-default -n openshift-ingress -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
      Copy to Clipboard Toggle word wrap

    2. If the cluster runs on GCP or Azure, set the INGRESS_HOST variable by running the following command: 

      $ INGRESS_HOST=$(oc get service router-default -n openshift-ingress -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
      Copy to Clipboard Toggle word wrap

    3. Send a curl request to the httpbin service using the host of the ingress router by running the following command: 

      $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST/headers
      Copy to Clipboard Toggle word wrap
  5. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.

2.4. Exposing a service by using the Kubernetes Gateway API in sidecar mode
Copia collegamento

You can use the Kubernetes Gateway API to create Gateway and HTTPRoute resources and deploy a gateway. The resources configure the gateway to expose a service in the mesh to traffic outside the mesh.

Prerequisites

  • You are logged in to the OpenShift Container Platform web console as a user with the cluster-admin role.
  • You installed the Red Hat OpenShift Service Mesh Operator.
  • You have deployed the Istio resource.

Procedure

  1. Create a namespace called httpbin by running the following command: 

    $ oc create namespace httpbin
    Copy to Clipboard Toggle word wrap

  2. When using sidecar injection instead of ambient mode, you must enable the sidecar injection in the namespace:

    1. For the InPlace upgrade strategy, run the following command: 

      $ oc label namespace httpbin istio-injection=enabled
      Copy to Clipboard Toggle word wrap

    2. For the RevisionBased upgrade strategy, run the following command: 

      $ oc label namespace httpbin istio.io/rev=<revision-name>
      Copy to Clipboard Toggle word wrap

  3. Deploy a sample service named httpbin by running the following command: 

    $ oc apply -n httpbin -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml
    Copy to Clipboard Toggle word wrap

  4. Create a YAML file named httpbin-gw.yaml that defines a Kubernetes Gateway resource, similar to the following example: 

    apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: httpbin-gateway
  namespace: httpbin
spec:
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: "httpbin.example.com"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
    Copy to Clipboard Toggle word wrap
    "httpbin.example.com"
    Specifies the virtual hostname that clients use when attempting to access a mesh service on the associated port.

    The HTTPRoute resource specifies the rules that route traffic from the gateway proxy to the httpbin service.

  5. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-gw.yaml
    Copy to Clipboard Toggle word wrap

  6. Create a YAML file named httpbin-ingress-hr.yaml that defines an HTTPRoute resource for the ingress gateway, similar to the following example: 

    apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin-ingress
  namespace: httpbin
spec:
  parentRefs:
  - name: httpbin-gateway
    namespace: httpbin
  hostnames:
  - "httpbin.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /status
    - path:
        type: PathPrefix
        value: /headers
  - backendRefs:
    - name: httpbin
      port: 8000
    Copy to Clipboard Toggle word wrap
    • spec.parentRefs binds the HTTPROUTE resource to the Kubernetes Gateway resource that was created in the earlier step.
    • spec.rules.backendRefs routes the matching traffic to the httpbin service by defining a backendRefs that includes the name and port of the httpbin service.

    The HTTPRoute resource specifies the rules that route traffic from the gateway proxy to the httpbin service.

  7. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-ingress-hr.yaml
    Copy to Clipboard Toggle word wrap

  8. Ensure that the Gateway API service is ready, and that an address is allocated to the service, by running the following command: 

    $ oc wait --for=condition=programmed gtw httpbin-gateway -n httpbin
    Copy to Clipboard Toggle word wrap

Verification

  1. Create a namespace for a curl client by running the following command: 

    $ oc create namespace curl
    Copy to Clipboard Toggle word wrap

  2. Deploy a curl client by running the following command: 

    $ oc apply -n curl -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml
    Copy to Clipboard Toggle word wrap

  3. Set a CURL_POD variable with the name of the curl pod by running the following command: 

    $ CURL_POD=$(oc get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')
    Copy to Clipboard Toggle word wrap

  4. Using the curl client, send a request to the /headers endpoint of the httpbin application through the ingress gateway Service resource. Set the Host header of the request to httpbin.example.com to match the host that the Kubernetes Gateway and HTTPROUTE resources specify. Send the curl request by running the following command: 

    $ oc exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    <gateway_name>-istio.<gateway_namespace>.svc.cluster.local/headers
    Copy to Clipboard Toggle word wrap

    The response should return a 200 OK HTTP status, which indicates that the request was successful, similar to the following example: 

    HTTP/1.1 200 OK
server: istio-envoy
...
    Copy to Clipboard Toggle word wrap

  5. Send a curl request to an endpoint that does not have a corresponding Uniform Resource Identifier (URI) prefix match defined in the httpbin HTTPROUTE by running the following command: 

    $ oc exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    <gateway_name>-istio.<gateway_namespace>.svc.cluster.local/get
    Copy to Clipboard Toggle word wrap

    The response returns a 404 Not Found status, as expected, because the /get endpoint does not have a matching URI prefix in the httpbin HTTPROUTE resource, similar to the following example: 

    HTTP/1.1 404 Not Found
server: istio-envoy
...
    Copy to Clipboard Toggle word wrap

  6. Expose the gateway proxy to traffic outside the cluster by setting the Service type to LoadBalancer. Run the following command: 

    $ oc patch service <gateway_name>-istio -n <gateway_namespace> -p '{"spec": {"type": "LoadBalancer"}}'
    Copy to Clipboard Toggle word wrap
    Note

    A gateway can also be exposed to traffic outside the cluster by using OpenShift Routes. For more information, see "Exposing a gateway to traffic outside the cluster using OpenShift Routes".

  7. Verify that the httpbin service can be accessed from outside the cluster when using the external hostname or IP address of the gateway Service resource. Ensure that you set the INGRESS_HOST variable appropriately for the environment in which your cluster is running.

    1. Set the INGRESS_HOST variable by running the following command: 

      $ export INGRESS_HOST=$(oc get gtw <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.addresses[0].value}')
      Copy to Clipboard Toggle word wrap

    2. Set the INGRESS_PORT variable by running the following command: 

      $ INGRESS_PORT=$(oc get gtw <gateway_name> -n <gateway_namespace> -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')
      Copy to Clipboard Toggle word wrap

    3. Using the gateway host, send a curl request to the httpbin service by running the following command: 

      $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST:$INGRESS_PORT/headers
      Copy to Clipboard Toggle word wrap
  8. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.

2.5. About ingress traffic routing approaches in ambient mode
Copia collegamento

When using the Istio ambient mode, you can use the Kubernetes Gateway API to configure ingress traffic routing.

Waypoint proxies for Layer 7 routing
You can deploy a waypoint proxy in the namespace that has your service to apply Layer 7 (L7) routing policies, such as path-based routing or header matching. In ambient mode, waypoint proxies process L7 traffic and enforce HTTPRoute and GRPCRoute rules.
Important

VirtualService resources are considered technology preview in ambient mode and should not be mixed with Gateway API configuration. The recommended approach in ambient mode is to use Kubernetes Gateway API resources.

2.6. Exposing a service by using the Kubernetes Gateway API in ambient mode
Copia collegamento

You can use the Kubernetes Gateway API to create Gateway and HTTPRoute resources and deploy a gateway in ambient mode. The resources configure the gateway to expose a service in the mesh to traffic outside the mesh.

Prerequisites

  • You are logged in to the OpenShift Container Platform web console as a user with the cluster-admin role.
  • You have installed the Red Hat OpenShift Service Mesh Operator.
  • You have deployed the Istio resource.
  • You use the Kubernetes-native Gateway API resources.
  • You are either using the Istio ambient mode or planning on migrating to the ambient mode.
Note

When using ambient mode (istio.io/dataplane-mode=ambient), it is recommended to use the Kubernetes Gateway API for ingress configuration, as Istio Gateway and VirtualService resources are not fully compatible with ambient mode.

Procedure

  1. Create a namespace called httpbin by running the following command: 

    $ oc create namespace httpbin
    Copy to Clipboard Toggle word wrap

  2. Apply the label for ambient mode by running the following command: 

    $ oc label namespace httpbin istio.io/dataplane-mode=ambient
    Copy to Clipboard Toggle word wrap

  3. Deploy a sample service named httpbin by running the following command: 

    $ oc apply -n httpbin -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml
    Copy to Clipboard Toggle word wrap

  4. Deploy a waypoint proxy by creating a YAML file named httpbin-waypoint.yaml, similar to the following example: 

    apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: httpbin-waypoint
  namespace: httpbin
  labels:
    istio.io/waypoint-for: service
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008
    protocol: HBONE
    Copy to Clipboard Toggle word wrap

  5. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-waypoint.yaml
    Copy to Clipboard Toggle word wrap

  6. Enable ingress waypoint routing on the httpbin service by running the following command: 

    $ oc label service httpbin -n httpbin istio.io/ingress-use-waypoint=true
    Copy to Clipboard Toggle word wrap

    The label ensures that traffic from the ingress gateway routes through the waypoint proxy and the L7 policies configured on the waypoint proxy are applied to the ingress traffic, before it reaches the httpbin service.

  7. Apply the waypoint label to the namespace so that all the services inside the namespace routes through the waypoint, by running the following command: 

    $ oc label ns httpbin istio.io/use-waypoint=httpbin-waypoint
    Copy to Clipboard Toggle word wrap

  8. Create a YAML file named httpbin-gw.yaml that defines a Kubernetes Gateway resource. This resource configures gateway proxies to expose port 80 (HTTP) for the host, httpbin.example.com. 

    apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: httpbin-gateway
  namespace: httpbin
spec:
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: "httpbin.example.com"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
    Copy to Clipboard Toggle word wrap
    "httpbin.example.com"
    Specifies the virtual hostname that clients use when attempting to access a mesh service on the associated port.

  9. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-gw.yaml
    Copy to Clipboard Toggle word wrap

  10. Create a YAML file named httpbin-ingress-hr.yaml that defines an HTTPRoute resource for the ingress gateway, similar to the following example: 

    apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin-ingress
  namespace: httpbin
spec:
  parentRefs:
  - name: httpbin-gateway
    namespace: httpbin
  hostnames:
  - "httpbin.example.com"
  rules:
  - backendRefs:
    - name: httpbin
      port: 8000
    Copy to Clipboard Toggle word wrap
    • spec.parentRefs binds the HTTPROUTE resource to the Kubernetes Gateway resource that was created in the earlier step.
    • spec.rules.backendRefs routes the matching traffic to the httpbin service by defining a backendRefs that includes the name and port of the httpbin service.

    The HTTPRoute resource specifies the rules that route traffic from the gateway proxy to the httpbin service.

  11. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-ingress-hr.yaml
    Copy to Clipboard Toggle word wrap

  12. Create a YAML file named httpbin-waypoint-hr.yaml that defines an HTTPRoute resource for the waypoint proxy. 

    apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin-waypoint-route
  namespace: httpbin
spec:
  parentRefs:
  - name: httpbin-waypoint
    namespace: httpbin
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /status
    - path:
        type: PathPrefix
        value: /headers
    backendRefs:
    - name: httpbin
      port: 8000
    Copy to Clipboard Toggle word wrap
    • spec.parentRefs binds the HTTPROUTE resource to the waypoint Gateway resource. It configures L7 routing rules that the waypoint will enforce.
    • spec.rules.backendRefs routes the matching traffic to the httpbin service by defining a backendRefs that includes the name and port of the httpbin service.

  13. Apply the YAML file by running the following command: 

    $ oc apply -f httpbin-waypoint-hr.yaml
    Copy to Clipboard Toggle word wrap
Note

In this example use case, traffic from the ingress gateway flows through the waypoint proxy because of the istio.io/ingress-use-waypoint=true label. The HTTPRoute resource then applies path-based routing policies before the traffic reaches the httpbin service.

  1. Ensure that the waypoint proxy is ready by running the following command: 

    $ oc wait --for=condition=programmed gtw httpbin-waypoint -n httpbin
    Copy to Clipboard Toggle word wrap

Verification

  1. Create a namespace for a curl client by running the following command: 

    $ oc create namespace curl
    Copy to Clipboard Toggle word wrap

  2. Deploy a curl client by running the following command: 

    $ oc apply -n curl
    Copy to Clipboard Toggle word wrap

  3. Apply the label for ambient mode to the curl namespace by running the following command: 

    $ oc label namespace curl istio.io/dataplane-mode=ambient
    Copy to Clipboard Toggle word wrap

  4. Set a CURL_POD variable with the name of the curl pod by running the following command: 

    $ CURL_POD=$(oc get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')
    Copy to Clipboard Toggle word wrap

  5. Using the curl client, send a request to the /headers endpoint of the httpbin application through the ingress gateway Service resource. Set the Host header of the request to httpbin.example.com to match the host that the Kubernetes Gateway and HTTPROUTE resources specify. Send the curl request by running the following command: 

    $ oc exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    <gateway_name>-istio.<gateway_namespace>.svc.cluster.local/headers
    Copy to Clipboard Toggle word wrap

    The response should return a 200 OK HTTP status, which indicates that the request was successful, similar to the following example: 

    HTTP/1.1 200 OK
server: istio-envoy
...
    Copy to Clipboard Toggle word wrap

  6. Send a curl request to an endpoint that does not have a corresponding Uniform Resource Identifier (URI) prefix match defined in the httpbin HTTPROUTE by running the following command: 

    $ oc exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    <gateway_name>-istio.<gateway_namespace>.svc.cluster.local/get
    Copy to Clipboard Toggle word wrap

    The response returns a 404 Not Found status, as expected, because the /get endpoint does not have a matching URI prefix in the httpbin HTTPROUTE resource, similar to the following example: 

    HTTP/1.1 404 Not Found
server: istio-envoy
...
    Copy to Clipboard Toggle word wrap

  7. Expose the gateway proxy to traffic outside the cluster by setting the Service type to LoadBalancer. Run the following command: 

    $ oc patch service <gateway_name>-istio -n <gateway_namespace> -p '{"spec": {"type": "LoadBalancer"}}'
    Copy to Clipboard Toggle word wrap
    Note

    A gateway can also be exposed to traffic outside the cluster by using OpenShift Routes. For more information, see "Exposing a gateway to traffic outside the cluster using OpenShift Routes".

  8. Verify that the httpbin service can be accessed from outside the cluster when using the external hostname or IP address of the gateway Service resource. Ensure that you set the INGRESS_HOST variable appropriately for the environment in which your cluster is running.

    1. Set the INGRESS_HOST variable by running the following command: 

      $ export INGRESS_HOST=$(oc get gtw <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.addresses[0].value}')
      Copy to Clipboard Toggle word wrap

    2. Set the INGRESS_PORT variable by running the following command: 

      $ INGRESS_PORT=$(oc get gtw <gateway_name> -n <gateway_namespace> -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')
      Copy to Clipboard Toggle word wrap

    3. Using the gateway host, send a curl request to the httpbin service by running the following command: 

      $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST:$INGRESS_PORT/headers
      Copy to Clipboard Toggle word wrap
  9. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.
Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat