Secure Kubernetes Services with Istio

This tutorial is intended for Kubernetes users and administrators who are interested in using Istio service mesh to securely deploy Kubernetes Services and enable mutual TLS (mTLS) communication.

Istio and Cloud Service Mesh

Istio is not a supported Google product. We recommend running managed Cloud Service Mesh instead. For more information, see Provision a managed Cloud Service Mesh control plane on GKE.

Cloud Service Mesh provides the following benefits:

  • You can provision managed Cloud Service Mesh using the Fleet API without client-side tools like istioctl.
  • Cloud Service Mesh automatically injects sidecar proxies into workloads without granting elevated privileges to your containers.
  • You can view rich dashboards for your mesh and services without any extra configuration and then use these metrics to configure service level objectives (SLOs) and alerts to monitor the health of your applications.
  • The managed Cloud Service Mesh control plane is upgraded automatically to ensure that you get the latest security patches and features.
  • The Cloud Service Mesh managed data plane automatically upgrades the sidecar proxies in your workloads so that you don't need to restart services yourself when proxy upgrades and security patches are available.
  • Cloud Service Mesh is a supported product and can be configured using standard open source Istio APIs. For more information, see supported features.

Objectives

This tutorial includes the following steps:

  • Create a GKE Autopilot cluster.
  • Install Istio using the istioctl command line tool.
  • Deploy a sample application to test mutual TLS (mTLS) authentication.
  • Configure Istio to use mTLS authentication for service-to-service communication using a PeerAuthentication custom resource.
  • Verify mTLS authentication using the Kiali dashboard.

Costs

In this document, you use the following billable components of Google Cloud:

To generate a cost estimate based on your projected usage, use the pricing calculator.

New Google Cloud users might be eligible for a free trial.

When you finish the tasks that are described in this document, you can avoid continued billing by deleting the resources that you created. For more information, see Clean up.

Before you begin

Cloud Shell is preinstalled with the software you need for this tutorial, including kubectl, the gcloud CLI, and Terraform. If you don't use Cloud Shell, you must install the gcloud CLI.

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. Install the Google Cloud CLI.

  3. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  4. To initialize the gcloud CLI, run the following command: 

    gcloud init

  5. Create or select a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.