Istio Service Mesh

# Download Istioctl
curl -L https://istio.io/downloadIstio | sh -
cd istio-*
export PATH=$PWD/bin:$PATH

# Install dengan profile default (includes Ingress Gateway)
istioctl install --set profile=default -y

# Verifikasi instalasi
istioctl verify-install
kubectl get pods -n istio-system

# Cek Istio version
istioctl version

# Install demo profile untuk testing (includes semua addons)
istioctl install --set profile=demo -y

# Install addons (Kiali, Grafana, Jaeger, Prometheus)
kubectl apply -f samples/addons/prometheus.yaml
kubectl apply -f samples/addons/grafana.yaml
kubectl apply -f samples/addons/jaeger.yaml
kubectl apply -f samples/addons/kiali.yaml

# Akses Kiali dashboard
istioctl dashboard kiali

# === METHOD 1: Namespace-level automatic injection ===
# Label namespace untuk inject otomatis semua pod baru
kubectl label namespace default istio-injection=enabled

# Verifikasi label
kubectl get namespace -L istio-injection

# Deploy aplikasi — sidecar akan di-inject otomatis
kubectl apply -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: my-app
          image: nginx:alpine
          ports:
            - containerPort: 80
          resources:
            limits:
              cpu: 200m
              memory: 256Mi
EOF

# Verifikasi sidecar ter-inject
kubectl get pod -l app=my-app -o jsonpath='{.items[0].spec.containers[*].name}'
# Output: my-app istio-proxy

# === METHOD 2: Pod-level injection ===
# Tambahkan annotation pada pod template
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
        - name: my-app
          image: nginx:alpine

# === METHOD 3: Manual injection ===
# Inject sidecar ke manifest yang sudah ada
kubectl apply -f <(istioctl kube-inject -f deployment.yaml)

# Atau gunakan istioctl analyze untuk validasi
istioctl analyze -n default

# Konfigurasi resource limits untuk sidecar
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    metadata:
      annotations:
        # Sidecar CPU dan memory limits
        sidecar.istio.io/proxyCPU: "100m"
        sidecar.istio.io/proxyMemory: "128Mi"
        sidecar.istio.io/proxyCPULimit: "500m"
        sidecar.istio.io/proxyMemoryLimit: "512Mi"
        # Intercept mode
        traffic.sidecar.istio.io/includeOutboundIPRanges: "10.0.0.0/8"
        traffic.sidecar.istio.io/excludeInboundPorts: "5432,6379"
    spec:
      containers:
        - name: my-app
          image: my-app:latest

---
# Sidecar resource — kontrol visibility per namespace
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: my-app-sidecar
  namespace: default
spec:
  workloadSelector:
    labels:
      app: my-app
  # Hanya import service yang dibutuhkan
  ingress:
    - port:
        number: 8080
        protocol: HTTP
        name: http
  egress:
    - hosts:
        - "default/*"           # Services di namespace default
        - "istio-system/*"      # Istio control plane
        - "database.svc.cluster.local"  # Specific service
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY  # Block traffic ke unknown hosts

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-app-vs
  namespace: default
spec:
  hosts:
    - my-app.example.com    # External hostname
    - my-app                # Internal service name
  gateways:
    - istio-ingressgateway  # External traffic
    - mesh                  # Internal mesh traffic
  http:
    # Route rules
    - match:
        - uri:
            prefix: /api/v2
          headers:
            x-user-type:
              exact: premium
      route:
        - destination:
            host: my-app
            subset: v2
            port:
              number: 8080
          weight: 100

    # Default route ke v1
    - route:
        - destination:
            host: my-app
            subset: v1
            port:
              number: 8080
          weight: 90
        - destination:
            host: my-app
            subset: v2
            port:
              number: 8080
          weight: 10
      timeout: 10s
      retries:
        attempts: 3
        perTryTimeout: 3s
        retryOn: "5xx,reset,connect-failure"

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-app-dr
  namespace: default
spec:
  host: my-app.default.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 5s
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
        maxRetries: 3
    loadBalancer:
      simple: LEAST_REQUEST  # ROUND_ROBIN, LEAST_CONN, RANDOM, PASSTHROUGH
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30
  subsets:
    - name: v1
      labels:
        version: v1
      trafficPolicy:
        connectionPool:
          http:
            http2MaxRequests: 500
    - name: v2
      labels:
        version: v2
      trafficPolicy:
        connectionPool:
          http:
            http2MaxRequests: 200

# Canary: 90% v1, 10% v2
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: canary-vs
spec:
  hosts:
    - my-app
  http:
    - route:
        - destination:
            host: my-app
            subset: v1
          weight: 90
        - destination:
            host: my-app
            subset: v2
          weight: 10

---
# Circuit breaker pattern
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-app-cb
spec:
  host: my-app
  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 3     # Setelah 3 error berturut-turut
      interval: 10s               # Check setiap 10 detik
      baseEjectionTime: 30s       # Eject minimal 30 detik
      maxEjectionPercent: 100     # Bisa eject semua instances

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: fault-test
spec:
  hosts:
    - my-app
  http:
    # Inject delay untuk testing resilience
    - match:
        - headers:
            x-test-scenario:
              exact: delay
      fault:
        delay:
          percentage:
            value: 50.0
          fixedDelay: 5s
      route:
        - destination:
            host: my-app

    # Inject HTTP error
    - match:
        - headers:
            x-test-scenario:
              exact: error
      fault:
        abort:
          percentage:
            value: 30.0
          httpStatus: 503
      route:
        - destination:
            host: my-app

    # Normal traffic
    - route:
        - destination:
            host: my-app

# Timeout configuration
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: timeout-config
spec:
  hosts:
    - my-app
  http:
    - route:
        - destination:
            host: my-app
      timeout: 10s
      retries:
        attempts: 3
        perTryTimeout: 3s
        retryOn: "5xx,reset,connect-failure,retriable-4xx"

# PeerAuthentication — enforce mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default-mtls
  namespace: default
spec:
  mtls:
    mode: STRICT  # STRICT, PERMISSIVE, DISABLE

# Allow only specific service to call my-app
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-api-gateway
  namespace: default
spec:
  selector:
    matchLabels:
      app: my-app
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/api-gateway"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/*"]

# Deny all other traffic
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  {}  # Empty spec = deny all

# Kiali — Service mesh visualization
istioctl dashboard kiali

# Grafana — Metrics dashboard
istioctl dashboard grafana

# Jaeger — Distributed tracing
istioctl dashboard jaeger

# Prometheus — Metrics backend
istioctl dashboard prometheus

# Zipkin — Alternatif distributed tracing
istioctl dashboard zipkin

# Port-forward manual jika diperlukan
kubectl port-forward -n istio-system svc/kiali 20001:20001
kubectl port-forward -n istio-system svc/grafana 3000:3000
kubectl port-forward -n istio-system svc/tracing 16686:80

# Custom Grafana dashboard untuk Istio metrics
# Tambahkan grafana dashboard via ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-custom-dashboard
  namespace: istio-system
  labels:
    grafana_dashboard: "1"
data:
  istio-mesh.json: |
    {
      "title": "Istio Custom Mesh Dashboard",
      "panels": [
        {
          "title": "Request Rate",
          "targets": [
            {
              "expr": "sum(rate(istio_requests_total{reporter=\"destination\"}[5m])) by (destination_service)"
            }
          ]
        }
      ]
    }