• Introduction
• Build
• Prerequisite
• Install
• Usage
• License

The east-west traffic in Istio is carried by envoy sidecars, which are deployed in every pod together with the application containers. Sidecars provide the functions of secure service-to-service communication, load balancing for various protocols, flexible traffic control and policy, and complete tracing.

However, there are also a few disadvantages of sidecars. First of all, deploying one sidecar to every pod can be resource-consuming and introduce complexity, especially when the number of pods is huge. Not only must those resources be provisioned to the sidecars, but also the control plane to manage the sidecar and to push configurations can be demanding. Second, a query needs to go through two sidecars, one in the source pod and the other one in the destination pod, in order to reach the destination. For delay-sensitive applications, sometimes, the extra time spent in the sidecars is not acceptable.

We noted that, for the majority of our HTTP applications, many of the rich features in sidecars are unused. That's why we want to propose a light-weighted way to serve east-west traffic without the drawbacks mentioned in the previous paragraph. Our focus is on the HTTP applications that do not require advanced security features, like mTLS.

We propose the centralized east-west traffic gateway, which moves the sidecars and the functionalities they carry to nodes that are dedicated for sidecars, and no application container shares those nodes. This way, no modifications are required on the nodes, and we can save on the resources and the delay. In addition, we can decouple the network management from application management, and also avoid the resource competition between application and networking. However, because we move the sidecars out of the nodes of applications, we at the same time lose some of the security and tracing abilities provided by the original sidecars. Our observation is that the majority of our applications do not require those features.

1. Dependency management(Optional)

go mod vendor

2. Build

go build -o bin/canal-controller cmd/main.go

3. Build cross-platform images(Optional)

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o bin/canal-controller cmd/main.go

4. Get a base image

docker pull docker.io/library/alpine:3.11.6

5. Build the image with the following Dockerfile

FROM alpine:3.11.6
COPY bin/canal-controller /canal-controller
CMD /canal-controller --logtostderr=true

docker build -f /path/to/your/Dockerfile . -t ${region}/${namespce}/canal:${tag}

docker push ${region}/${namespce}/canal:${tag}

helm install istio-base ./base -n istio-system

helm install istiod ./istio-discovery/ -n istio-system

helm install canal-gateway ./canal -n istio-system

helm install canal-control ./canal-control -n istio-system \
    --set global.hub=${your hub} \
    --set global.imagePullSecrets[0]=${your secret} \
    --set global.tag=${your tag}

apiVersion: v1
kind: Service
metadata:
  name: helloworld
  labels:
    app: helloworld
spec:
  ports:
  - port: 5000
    name: http
  selector:
    app: helloworld
---

kind: Gateway
metadata:
  name: canal
  namespace: istio-system
spec:
  selector:
    app: canal-gateway
  servers:
  - port:
      number: 5000
      name: http
      protocol: HTTP
    hosts:
    - "*"
---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - canal
  http:
  - match:
    - uri:
        exact: /hello
    route:
    - destination:
        host: helloworld.default.svc.cluster.local
---

dig helloworld.default.svc.cluster.local

kind: Gateway
metadata:
  name: canal
  namespace: istio-system
spec:
  selector:
    app: canal-gateway
  servers:
  - port:
      number: 5000
      name: http
      protocol: HTTP
    hosts:
    - "*"
---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - canal
  http:
  - match:
    - uri:
        exact: /hello
    route:
    - destination:
        host: helloworld.default.svc.cluster.local
---

kubectl label namespace your-namespace istio-injection=disabled

kind: Gateway
metadata:
  name: canal
  namespace: istio-system
spec:
  selector:
    app: canal-gateway
  servers:
  - port:
      number: 5000
      name: http
      protocol: HTTP
    hosts:
    - "*"
---

apiVersion: v1
kind: Service
metadata:
  name: helloworld-on-canal
  labels:
    app: helloworld-on-canal
spec:
  ports:
  - port: 5000
    name: http
  selector:
    app: helloworld-on-canal
---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld-on-canal
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - canal
  http:
  - match:
    - uri:
        exact: /hello
    route:
    - destination:
        host: helloworld-on-canal.default.svc.cluster.local