#Installing a mesh in dual-stack mode

#Install IstioCNI

Install the IstioCNI resource by running the following command:

kubectl create namespace istio-cni
cat <<EOF | kubectl apply -f -
apiVersion: sailoperator.io/v1
kind: IstioCNI
metadata:
  name: default
spec:
  version: v1.30.4
  namespace: istio-cni
  values:
    cni:
      cniConfDir: /etc/cni/multus/net.d
      excludeNamespaces:
        - istio-cni
        - kube-system
EOF

#Install Istio with dual-stack configuration

1. Create an Istio resource with dual-stack configuration by running the following command:

   kubectl create namespace istio-system
   cat <<EOF | kubectl apply -f -
   apiVersion: sailoperator.io/v1
   kind: Istio
   metadata:
     name: default
   spec:
     version: v1.30.4
     namespace: istio-system
     values:
       global:
         proxy:
           seccompProfile:
             type: RuntimeDefault
       meshConfig:
         defaultConfig:
           proxyMetadata:
             ISTIO_DUAL_STACK: "true"
       pilot:
         ipFamilyPolicy: RequireDualStack
         env:
           ISTIO_DUAL_STACK: "true"
   EOF

2. Wait for the control plane to return the Ready status condition by running the following command:

   kubectl wait --for condition=Ready istio/default --timeout=3m

#Create namespaces for the sample applications

Create the following namespaces, each hosting the tcp-echo service with a specific IP configuration:

• dual-stack: hosts a tcp-echo service that listens on both IPv4 and IPv6 addresses.

• ipv4: hosts a tcp-echo service listening only on IPv4 addresses.

• ipv6: hosts a tcp-echo service listening only on IPv6 addresses.

• sleep: hosts the client application for sending test requests.

  kubectl create namespace dual-stack
  kubectl label namespace dual-stack pod-security.kubernetes.io/enforce=restricted --overwrite
  kubectl create namespace ipv4
  kubectl label namespace ipv4 pod-security.kubernetes.io/enforce=restricted --overwrite
  kubectl create namespace ipv6
  kubectl label namespace ipv6 pod-security.kubernetes.io/enforce=restricted --overwrite
  kubectl create namespace sleep
  kubectl label namespace sleep pod-security.kubernetes.io/enforce=restricted --overwrite

#Enable sidecar injection for the namespaces

Label the namespaces to enable automatic Istio sidecar injection by running the following command:

kubectl label namespace dual-stack istio-injection=enabled
kubectl label namespace ipv4 istio-injection=enabled
kubectl label namespace ipv6 istio-injection=enabled
kubectl label namespace sleep istio-injection=enabled

#Deploy the sample applications

1. Deploy the tcp-echo application with dual-stack configuration:

   kubectl apply -n dual-stack -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/tcp-echo/tcp-echo-dual-stack.yaml

2. Deploy the tcp-echo application with IPv4-only configuration:

   kubectl apply -n ipv4 -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/tcp-echo/tcp-echo-ipv4.yaml

3. Deploy the tcp-echo application with IPv6-only configuration:

   kubectl apply -n ipv6 -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/tcp-echo/tcp-echo-ipv6.yaml

4. Deploy the sleep application, which will act as a client for sending test requests:

   kubectl apply -n sleep -f https://raw.githubusercontent.com/alauda-mesh/istio/refs/heads/istio-1.30/samples/sleep/sleep.yaml

5. Wait for all deployments to become available:

   kubectl wait --for=condition=Ready pod -n dual-stack -l app=tcp-echo --timeout=3m
   kubectl wait --for=condition=Ready pod -n ipv4 -l app=tcp-echo --timeout=3m
   kubectl wait --for=condition=Ready pod -n ipv6 -l app=tcp-echo --timeout=3m
   kubectl wait --for=condition=Ready pod -n sleep -l app=sleep --timeout=3m

#Verify the dual-stack service configuration

Confirm that the tcp-echo service in the dual-stack namespace is configured with ipFamilyPolicy of RequireDualStack by running the following command:

kubectl get service tcp-echo -n dual-stack -o=jsonpath='{.spec.ipFamilyPolicy}'

Example output

RequireDualStack

#Verify connectivity to dual-stack services

Send a test request from the sleep pod to the dual-stack tcp-echo service by running the following command:

kubectl exec -n sleep deploy/sleep -- sh -c "echo dualstack | nc tcp-echo.dual-stack 9000"

Example output

hello dualstack

#Verify connectivity to IPv4 and IPv6 services

1. Send a test request to the IPv4-only tcp-echo service:

   kubectl exec -n sleep deploy/sleep -- sh -c "echo ipv4 | nc tcp-echo.ipv4 9000"

   Example output

   hello ipv4

2. Send a test request to the IPv6-only tcp-echo service:

   kubectl exec -n sleep deploy/sleep -- sh -c "echo ipv6 | nc tcp-echo.ipv6 9000"

   Example output

   hello ipv6