Traefik Loadbalancer is enabled in my AKS cluster needs to use istio service mesh for mtls

Question

Traefik Loadbalancer is enabled in my AKS cluster needs to use istio service mesh for mtls

Naga Teja 0

Traefik Loadbalancer is used as external loadbalancer need to use istio for mtls in my AKS cluster if i enable istio addon will it help for me to set up only mtls without loadbalancer.
The aim is to make communication between the pods using istio and external communication using traefik.

deherman-MSFT 38,026 Reputation points Microsoft Employee Moderator

2024-06-27T15:32:53.9933333+00:00

@Naga Teja

There is the Istio-based service mesh add-on for Azure Kubernetes Service. Please check to see if this fits your needs. Enabling Istio for mTLS within your AKS cluster and using Traefik for external communication is a valid approach. Just ensure that Traefik is configured correctly to handle external traffic, and Istio will take care of secure communication between your pods.
Naga Teja 0 Reputation points

2024-06-28T05:11:13.4166667+00:00

@deherman-MSFT
Thanks for the update here my major query is that how communication between the traefik pod and my application pods why because traefik will not communicate with service name it is going to pick pod ip.
By the way traefik is already configured in my environment and running fine. Need to install istio add-on wanted to know whether it is perfect approach or not.

1 answer

Your answer

deherman-MSFT 38,026 Reputation points Microsoft Employee Moderator

2024-06-27T15:32:53.9933333+00:00

@Naga Teja

There is the Istio-based service mesh add-on for Azure Kubernetes Service. Please check to see if this fits your needs. Enabling Istio for mTLS within your AKS cluster and using Traefik for external communication is a valid approach. Just ensure that Traefik is configured correctly to handle external traffic, and Istio will take care of secure communication between your pods.
Naga Teja 0 Reputation points

2024-06-28T05:11:13.4166667+00:00

@deherman-MSFT
Thanks for the update here my major query is that how communication between the traefik pod and my application pods why because traefik will not communicate with service name it is going to pick pod ip.
By the way traefik is already configured in my environment and running fine. Need to install istio add-on wanted to know whether it is perfect approach or not.

Answer 1

Hello Naga Teja

To make a bit more clarification:

The Istio-based service mesh add-on for Azure Kubernetes Service (AKS) provides an officially supported and tested integration with Istio.

When communication occurs between your application pods (inside the AKS cluster), Istio takes over.

Istio add-on is a valid approach for achieving mTLS and other service mesh features.

User's image

https://thenewstack.io/using-traefik-ingress-controller-with-istio-service-mesh/

There are also some limitations to consider:

The add-on doesn't work on AKS clusters that have Istio installed on them already outside the add-on installation.
The add-on doesn't support adding pods associated with virtual nodes to be added under the mesh.
Istio doesn't support Windows Server containers.

https://learn.microsoft.com/en-us/azure/aks/istio-about

Share via

Traefik Loadbalancer is enabled in my AKS cluster needs to use istio service mesh for mtls

1 answer

Your answer