I am busy changing the world

As you may know, you can enable automatic sidecar injection for a specific namespace with istio: kubectl label namespace ABC istio-injection=enabled It means that every new service deployed in the ABC namespace will be injected with an Envoy sidecar. In case you don't want a specific service such as MyService to be controlled by Istio, you can set the annotation ' sidecar.istio.io/inject ' to ' false '. For example: References: https://istio.io/docs/reference/config/annotations/

I've spent a couple of days exploring Keycloak, Istio, and EKS. The result is a sample Flask app that has these following features: User registration and authentication (OIDC) with Keycloak The app can be running on a local machine, in a Docker container, or inside a service mesh within a Kubernetes cluster and Istio. In that case, Istio and Keycloak were deployed on an EKS cluster following this tutorial [1]. The sample app repository is here [2]. Below are the detail instructions to run the sample app. Prerequisites Have a Keycloak instance up and running and you know the admin user credentials If you want to deploy the app on a Kubernetes cluster with Istio installed, make sure you have admin privileges to the cluster. You also need to install istioctl . Run the application normally 1. Clone the repo, install the requirements git clone https://github.com/dangtrinhnt/keycloak_flask cd keycloak_flask virtualenv ~/keycloak_flask source ~/keycloak_flask/bin/activa...

By default, when you deploy istio on a Kubernetes cluster, it will create a load balancer name istio-ingressgateway [1]. That ingress gateway is a Kubernetes's LoadBalancer resource that helps handling incoming traffic into the mesh. You can check by running this command: kubectl -n istio-system get service istio-ingressgateway The istio-ingressgateway load balancer will open a number of ports such as 80, 443, etc. If you want to open a new port on the load balancer, you can do like the following: 1. Export the current configuration of the istio-ingressgateway kubectl -n istio-system get service istio-ingressgateway -o yaml > istio_ingressgateway.yaml 2. Edit the istio_ingressgateway.yaml, add the new port you want, for example nano istio_ingressgateway.yaml ...   - name: myport     nodePort: 31410     port: 5000     protocol: TCP     targetPort: 5000 ... 3. Apply the new configuration kubectl apply -f istio_ingress...

When evaluating Istio to use in our AWS EKS clusters environment, I found it is a little bit confusing with end-user authentication which cost me a couple days to set up a running scenario. Moreover, most of the blog posts and online documents only mention end-user authentication with Auth0 (a proprietary authentication solution) or very limited to other software such as KeyCloak. This article describes how I did the configuration to make it work with KeyCloak as well as briefly explaining the authentication flow of Istio. As you may know, Istio introduces two types of authentication which are Transport Authentication and Origin Authentication [0]. Transport Authentication is used for the service to service authentication while Origin Authentication is used for end-user authentication. But, when it comes to real configuration, it looks like I have to apply both types if I want to set up the scenario as follows: Figure 1: Expected scenario What I expected to have are: End-user...