For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.

Istio Service Mesh

While it is possible to deploy Multi-Cluster Ops Manager, Multi-Cluster Sharded Cluster, and Multi-Cluster Replica Set configurations without a service mesh, the recommended approach (presented here) is to leverage a service mesh to handle the networking across multiple Kubernetes clusters. To learn more, see How Does the Kubernetes Operator Establish Connectivity.

This page walks you through the process of deploying and validating an Istio service mesh across multiple Kubernetes clusters. Istio is only one of many options for deploying a service mesh, and it is not supported by MongoDB.

Note

Istio is not supported by MongoDB

Istio is not supported by MongoDB and is only one of many tools you can use to deploy a service mesh across your Kubernetes clusters.

Prerequisites

Before you begin, perform the following tasks:

  • Install kubectl.

  • Set the K8S_CLUSTER_*_CONTEXT_NAME environment variables as explained in the GKE Clusters guide.

Source Code

You can find all included source code in the MongoDB Kubernetes Operator repository.

Procedure

1

Clone the Kubernetes Operator repository.

Run the following command to clone the repository.

git clone https://github.com/mongodb/mongodb-kubernetes.gitcd mongodb-kubernetesgit checkout 1.15.0cd public/architectures
2

Install Istio service mesh.

Install Istio service mesh to allow cross-cluster DNS resolution and network connectivity between Kubernetes clusters.

CTX_CLUSTER1=${K8S_CLUSTER_0_CONTEXT_NAME} \CTX_CLUSTER2=${K8S_CLUSTER_1_CONTEXT_NAME} \CTX_CLUSTER3=${K8S_CLUSTER_2_CONTEXT_NAME} \ISTIO_VERSION="1.20.2" \./install_istio_separate_network.sh
3

Label the Kubernetes namespaces.

Label the Kubernetes namespaces in each cluster to enable Istio sidecar injection.

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwrite
4

Optional. Check cluster connectivity.

The following optional scripts verify whether the service mesh is configured correctly for cross-cluster DNS resolution and connectivity.

  1. Create a Kubernetes namespace for the connectivity test.

    kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create namespace "connectivity-test"kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create namespace "connectivity-test"kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create namespace "connectivity-test"kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite

  2. Run this script on cluster 0:

    kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF  apiVersion: apps/v1  kind: StatefulSet  metadata:    name: echoserver0  spec:    replicas: 1    selector:      matchLabels:        app: echoserver0    template:      metadata:        labels:          app: echoserver0      spec:        containers:          - image: k8s.gcr.io/echoserver:1.10            imagePullPolicy: Always            name: echoserver0            ports:              - containerPort: 8080EOF

  3. Run this script on cluster 1:

    kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF  apiVersion: apps/v1  kind: StatefulSet  metadata:    name: echoserver1  spec:    replicas: 1    selector:      matchLabels:        app: echoserver1    template:      metadata:        labels:          app: echoserver1      spec:        containers:          - image: k8s.gcr.io/echoserver:1.10            imagePullPolicy: Always            name: echoserver1            ports:              - containerPort: 8080EOF

  4. Run this script on cluster 2:

    kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF  apiVersion: apps/v1  kind: StatefulSet  metadata:    name: echoserver2  spec:    replicas: 1    selector:      matchLabels:        app: echoserver2    template:      metadata:        labels:          app: echoserver2      spec:        containers:          - image: k8s.gcr.io/echoserver:1.10            imagePullPolicy: Always            name: echoserver2            ports:              - containerPort: 8080EOF

  5. Run this script to wait for the creation of StatefulSets:

    kubectl wait --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver0-0 --timeout=60skubectl wait --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver1-0 --timeout=60skubectl wait --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver2-0 --timeout=60s

  6. Create Pod service on cluster 0:

    kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserver0-0spec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    statefulset.kubernetes.io/pod-name: "echoserver0-0"EOF

  7. Create Pod service on cluster 1:

    kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserver1-0spec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    statefulset.kubernetes.io/pod-name: "echoserver1-0"EOF

  8. Create Pod service on cluster 2:

    kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserver2-0spec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    statefulset.kubernetes.io/pod-name: "echoserver2-0"EOF

  9. Create round robin service on cluster 0:

    kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserverspec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    app: echoserver0EOF

  10. Create round robin service on cluster 1:

    kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserverspec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    app: echoserver1EOF

  11. Create round robin service on cluster 2:

    kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserverspec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    app: echoserver2EOF

  12. Verify Pod 0 from cluster 1:

    source_cluster=${K8S_CLUSTER_1_CONTEXT_NAME}target_pod="echoserver0-0"source_pod="echoserver1-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  13. Verify Pod 1 from cluster 0:

    source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}target_pod="echoserver1-0"source_pod="echoserver0-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  14. Verify Pod 1 from cluster 2:

    source_cluster=${K8S_CLUSTER_2_CONTEXT_NAME}target_pod="echoserver1-0"source_pod="echoserver2-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  15. Verify Pod 2 from cluster 0:

    source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}target_pod="echoserver2-0"source_pod="echoserver0-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  16. Run the cleanup script:

    kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver0kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver1kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver2kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete service echoserverkubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete service echoserverkubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete service echoserverkubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver0-0kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver1-0kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver2-0kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete ns "connectivity-test"kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" delete ns "connectivity-test"kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" delete ns "connectivity-test"
Back
GKE Clusters
Next
TLS Certificates
Rate this page

On this page