Alauda Service Mesh v2 Docs
  • English

    • Deploying the Bookinfo application in ambient mode

    You can deploy the Bookinfo sample application in ambient mode without sidecar injection by relying on the ZTunnel proxy. For background on the Bookinfo application, see Deploying the Bookinfo Application.

    TOC

    Deploying the Bookinfo ApplicationPrerequisitesProcedureVerificationAccessing the Bookinfo Application via a GatewayPrerequisitesProcedureVerificationCleanupAdditional resources

    Deploying the Bookinfo Application

    Prerequisites

    • An active ACP CLI (kubectl) session by a cluster administrator with the cluster-admin role.
    • You have istioctl installed locally so that you can use to run these instructions.
    • Alauda Service Mesh Operator 2.1.1 or later is installed the Istio resource has been created, and the Operator has deployed Istio.
    • An IstioCNI resource has been created, and the Operator has deployed the required IstioCNI pods.
    • A ZTunnel resource has been created, and the Operator has deployed the required ZTunnel pods.

    Procedure

    1. Create the bookinfo namespace:

      kubectl create namespace bookinfo
kubectl label namespace bookinfo pod-security.kubernetes.io/enforce=restricted --overwrite

    2. Add the istio-discovery=enabled label to the bookinfo namespace:

      kubectl label namespace bookinfo istio-discovery=enabled

    3. Deploy the Bookinfo application:

      kubectl apply -n bookinfo -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/bookinfo/platform/kube/bookinfo.yaml

      Apply the bookinfo-versions YAML file to create multiple versions of the Bookinfo services:

      kubectl apply -n bookinfo -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/bookinfo/platform/kube/bookinfo-versions.yaml

    4. Enroll the Bookinfo application in the ambient mesh by labeling either the entire namespace or individual pods:

      • To include all workloads in the bookinfo namespace:

        kubectl label namespace bookinfo istio.io/dataplane-mode=ambient

      • To include only specific workloads, apply the istio.io/dataplane-mode=ambient label directly to individual pods. See the Additional resources section for details on the labels used to add or exclude workloads from the mesh.

        NOTE

        Enrolling workloads in the ambient mesh does not require restarting or redeploying application pods. Unlike sidecar mode, the number of containers in each pod remains unchanged.

    Verification

    1. To confirm the bookinfo services are available, run this command:

      kubectl get services -n bookinfo

      Example output

      NAME             TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
details          ClusterIP   10.4.119.2     <none>        9080/TCP   2m35s
details-v1       ClusterIP   10.4.1.117     <none>        9080/TCP   2m30s
productpage      ClusterIP   10.4.103.113   <none>        9080/TCP   2m35s
productpage-v1   ClusterIP   10.4.18.45     <none>        9080/TCP   2m30s
ratings          ClusterIP   10.4.59.87     <none>        9080/TCP   2m35s
ratings-v1       ClusterIP   10.4.176.204   <none>        9080/TCP   2m30s
reviews          ClusterIP   10.4.210.99    <none>        9080/TCP   2m35s
reviews-v1       ClusterIP   10.4.46.223    <none>        9080/TCP   2m30s
reviews-v2       ClusterIP   10.4.195.242   <none>        9080/TCP   2m30s
reviews-v3       ClusterIP   10.4.2.53      <none>        9080/TCP   2m30s

    2. To check that the bookinfo pods are available, execute the following command:

      kubectl get pods -n bookinfo

      Example output

      NAME                              READY   STATUS    RESTARTS   AGE
details-v1-569946bc86-f5xks       1/1     Running   0          2m30s
productpage-v1-6c76dd65f7-tk5mr   1/1     Running   0          2m29s
ratings-v1-5fd569d7c8-5x778       1/1     Running   0          2m30s
reviews-v1-7668bf774d-qvpjh       1/1     Running   0          2m30s
reviews-v2-55dd985686-bxv5v       1/1     Running   0          2m29s
reviews-v3-5d7d6bddd8-2wr5w       1/1     Running   0          2m29s

      Because ambient mode does not inject a proxy sidecar, the Ready column shows 1/1. Ensure the Status column for each pod shows Running.

    3. Confirm the bookinfo application is running by sending a request to its product page. Execute this command:

      kubectl exec "$(kubectl get pod -l app=ratings -n bookinfo \
  -o jsonpath='{.items[0].metadata.name}')" \
  -c ratings -n bookinfo \
  -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"

      Example output

      <title>Simple Bookstore App</title>

    4. Confirm that the ZTunnel proxy has successfully established listening sockets in the pod network namespaces:

      istioctl -n ztunnel ztunnel-config workloads

      After adding bookinfo namespace to the Ambient mesh, you would see HBONE protocol.

      Example output

      NAMESPACE    POD NAME                        ADDRESS    NODE           WAYPOINT PROTOCOL
bookinfo     details-v1-569946bc86-f5xks     10.3.0.143 192.168.131.32 None     HBONE
bookinfo     productpage-v1-6c76dd65f7-tk5mr 10.3.0.148 192.168.131.32 None     HBONE
bookinfo     ratings-v1-5fd569d7c8-5x778     10.3.0.144 192.168.131.32 None     HBONE
bookinfo     reviews-v1-7668bf774d-qvpjh     10.3.0.145 192.168.131.32 None     HBONE
bookinfo     reviews-v2-55dd985686-bxv5v     10.3.0.146 192.168.131.32 None     HBONE
bookinfo     reviews-v3-5d7d6bddd8-2wr5w     10.3.0.147 192.168.131.32 None     HBONE
istio-cni    istio-cni-node-vfrbr            10.3.0.140 192.168.131.32 None     TCP
istio-system istiod-57f9449cdd-56gl8         10.3.0.141 192.168.131.32 None     TCP
ztunnel      ztunnel-lf7c9                   10.3.0.142 192.168.131.32 None     TCP

    Accessing the Bookinfo Application via a Gateway

    Gateways are not deployed by the Alauda Service Mesh v2 Operator because they are not considered part of the control plane. In ambient mode, the Kubernetes Gateway API is the only supported way to configure ingress traffic: a gateway is deployed through the creation of a Gateway resource, and the routing rules are defined with an HTTPRoute resource.

    WARNING

    In ambient mode, VirtualService resources have limited compatibility and should not be combined with Gateway API configuration. Use Kubernetes Gateway API resources as the standard approach for traffic routing in ambient mode.

    Prerequisites

    • The bookinfo application is deployed and enrolled in the ambient mesh, as described in the previous procedure.
    • Gateway API CRDs are installed.
    • Your Kubernetes cluster supports external load balancers (i.e., Services of type LoadBalancer).

    Procedure

    1. Add the istio gateway class overlay to the Istio resource so that the gateway pod is admitted into the Restricted bookinfo namespace:

      kubectl patch istio default --type=merge -p '{"spec":{"values":{"gatewayClasses":{"istio":{"deployment":{"spec":{"template":{"spec":{"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}}}}}}}}}}}'

      For more information, see Pod Security Admission.

    2. Create and configure a gateway with the Gateway and HTTPRoute resources by executing the command below:

      kubectl -n bookinfo apply -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/bookinfo/gateway-api/bookinfo-gateway.yaml
      NOTE

      This example uses a sample gateway configuration file to configure a gateway for the bookinfo application via the Gateway API. This file must be applied in the application's namespace.

    3. Ensure the Gateway API service is ready and has an address by running the following command:

      kubectl wait --for=condition=programmed gtw bookinfo-gateway -n bookinfo

    4. Retrieve the host with this command:

      export INGRESS_HOST=$(kubectl get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.status.addresses[0].value}')
echo "INGRESS_HOST=$INGRESS_HOST"

    5. Retrieve the port with this command:

      export INGRESS_PORT=$(kubectl get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')
echo "INGRESS_PORT=$INGRESS_PORT"

    6. Retrieve the gateway URL with this command:

      INFO

      If $INGRESS_HOST is an IPv6 address, enclose it in square brackets when constructing the URL. For example:

      export GATEWAY_URL=[$INGRESS_HOST]:$INGRESS_PORT
      export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT

    7. Get the full URL for the product page by running the following command:

      echo "http://${GATEWAY_URL}/productpage"

    Verification

    • Confirm that the productpage is accessible with the curl command:

      curl -sS -g "http://${GATEWAY_URL}/productpage" | grep -o "<title>.*</title>"

      Example output

      <title>Simple Bookstore App</title>

    • Confirm that the productpage is accessible in a web browser.

      Point your browser to http://${GATEWAY_URL}/productpage to view the Bookinfo web page.

      When you refresh the page several times, you should see different versions of reviews shown in productpage, presented in a round robin style (red stars, black stars, no stars), since we haven't yet used Istio to control the version routing.

    Cleanup

    When you are finished exploring the Bookinfo application, remove the application and all of its associated gateway resources by deleting the bookinfo namespace:

    # Remove the namespace from the ambient data plane
kubectl label namespace bookinfo istio.io/dataplane-mode-
# Remove the Bookinfo namespace
kubectl delete namespace bookinfo

    Additional resources