3 ms·

If you don't want any of the fancy stuff, then you can just use Envoy without Istio and configure it yourself.

• vbezhenar 3y ago
  That's an interesting thought. Even if I would throw it away for istio in the end, the experience for managing Envoy, might be valuable. How do I do that exactly? I need to install some iptables rules inside a pod to redirect pod traffic to envoy?
  • shitlord 3y ago
    Envoy is the proxy that does the heavy lifting. Istio is just a glorified configuration system. Even if you choose to use Istio you're still using Envoy. You're spot-on about using iptables rules. There is an example here with a yaml configuration and some iptables commands: https://github.com/envoyproxy/envoy/blob/main/configs/original-dst-cluster/README.md https://github.com/envoyproxy/envoy/blob/main/configs/origin... You might be able to re-use some of that. It should be pretty easy to get metrics for outbound/inbound http requests, but I don't remember the exact yaml incantation.
    • vbezhenar 3y ago
      Thanks, I'll look into that. Might actually be the simplest solution in the end.
      • ceposta07 3y ago
        lol i’m not quite following how manually injecting envoy, “configuring envoy yourself/by hand” in a pod and “copying istio code for iptables re-direction” and then trying to maintain this yourself is easier than just using istio? install istio, turn off mtls if you dont want that (https://istio.io/latest/docs/reference/config/security/peer_authentication/#PeerAuthentication-MutualTLS-Mode https://istio.io/latest/docs/reference/config/security/peer_...) and you have what you’re looking for. doesn’t get simpler than that.