| Giorgi Lekveishvili | 4ec4c02 | 2024-08-17 15:09:24 +0400 | [diff] [blame] | 1 | # Istio |
| 2 | |
| 3 | Istio provides an alternative way to control ingress traffic into the cluster. |
| 4 | In addition, it allows to finetune the traffic inside the cluster and provides |
| 5 | a huge repertoire of load balancing and routing mechanisms. |
| 6 | |
| 7 | ***note |
| 8 | Currently, only the Gerrit replica chart allows using istio out of the box. |
| 9 | *** |
| 10 | |
| 11 | ## Install istio |
| 12 | |
| 13 | An example configuration based on the default profile provided by istio can be |
| 14 | found under `./istio/src/`. Some values will have to be adapted to the respective |
| 15 | system. These are marked by comments tagged with `TO_BE_CHANGED`. |
| 16 | To install istio with this configuration, run: |
| 17 | |
| 18 | ```sh |
| 19 | kubectl apply -f istio/istio-system-namespace.yaml |
| 20 | istioctl install -f istio/gerrit.profile.yaml |
| 21 | ``` |
| 22 | |
| 23 | To install Gerrit using istio for networking, the namespace running Gerrit has to |
| 24 | be configured to enable sidecar injection, by setting the `istio-injection: enabled` |
| 25 | label. An example for such a namespace can be found at `./istio/namespace.yaml`. |
| 26 | |
| 27 | ## Uninstall istio |
| 28 | |
| 29 | To uninstall istio, run: |
| 30 | |
| 31 | ```sh |
| 32 | istioctl uninstall -f istio/gerrit.profile.yaml |
| 33 | ``` |
| 34 | |
| 35 | ## Restricting access to a list of allowed IPs |
| 36 | |
| 37 | In development setups, it might be wanted to allow access to the setup only from |
| 38 | specified IPs. This can be done by patching the `spec.loadBalancerSourceRanges` |
| 39 | value of the service used for the IngressGateway. A patch doing that can be |
| 40 | uncommented in `istio/gerrit.profile.yaml`. |