3 ms·
That's an interesting thought. Even if I would throw it away for istio in the end, the experience for managing Envoy, might be valuable. How do I do that exact
by vbezhenar 3y ago
That's an interesting thought. Even if I would throw it away for istio in the end, the experience for managing Envoy, might be valuable.
How do I do that exactly? I need to install some iptables rules inside a pod to redirect pod traffic to envoy?
- shitlord 3y agoEnvoy is the proxy that does the heavy lifting. Istio is just a glorified configuration system. Even if you choose to use Istio you're still using Envoy. You're spot-on about using iptables rules. There is an example here with a yaml configuration and some iptables commands: https://github.com/envoyproxy/envoy/blob/main/configs/original-dst-cluster/README.md https://github.com/envoyproxy/envoy/blob/main/configs/origin... You might be able to re-use some of that. It should be pretty easy to get metrics for outbound/inbound http requests, but I don't remember the exact yaml incantation.
- vbezhenar 3y agoThanks, I'll look into that. Might actually be the simplest solution in the end.
- ceposta07 3y agolol i’m not quite following how manually injecting envoy, “configuring envoy yourself/by hand” in a pod and “copying istio code for iptables re-direction” and then trying to maintain this yourself is easier than just using istio? install istio, turn off mtls if you dont want that (https://istio.io/latest/docs/reference/config/security/peer_authentication/#PeerAuthentication-MutualTLS-Mode https://istio.io/latest/docs/reference/config/security/peer_...) and you have what you’re looking for. doesn’t get simpler than that.