AKS Istio Service Mesh and Ingress Controller(Istio gateway or NGINX)

Question

AKS Istio Service Mesh and Ingress Controller(Istio gateway or NGINX)

pike liang 20

Hi,

We are implementing AKS with service mesh enabled and we also want to support app routing in two ingress controller in different subnets, can you help with the following questions?

Can Azure Istio addon Service Mesh work together with NGINX ingress controller?
Can Azure Istio addon ingress gateway support multiple intranet gateway with different subnets?

Thanks a lot!

Accepted answer

0 additional answers

Your answer

Answer 1

Anusree Nashetty 4,785 Microsoft External Staff Moderator

Hi pike liang,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

1.Can Azure Istio addon Service Mesh work together with NGINX ingress controller?

Yes, the Azure Istio Service Mesh add-on can operate alongside the NGINX ingress controller on Azure Kubernetes Service (AKS). They manage traffic in distinct ways: Istio enhances service-to-service communication, security, and observability, whereas the NGINX ingress controller is tasked with routing HTTP/S traffic into your cluster.

2.Can Azure Istio addon ingress gateway support multiple intranet gateway with different subnets?

The Azure Istio add-on for AKS does have specific limitations regarding the configuration of ingress gateways. While Istio itself can be configured to use multiple ingress gateways for different traffic patterns or subnets in a standard deployment, the Azure-managed Istio add-on currently does not support deploying multiple internal ingress gateways in different subnets.

If you need to set up multiple ingress controllers in different subnets, you might need to manage Istio manually instead of using the Azure Istio add-on, as the add-on is optimized for simpler scenarios and does not yet support complex multi-gateway configurations.

For more information, please look into:

https://docs.nginx.com/nginx-ingress-controller/tutorials/nginx-ingress-istio/

https://learn.microsoft.com/en-us/azure/aks/istio-deploy-ingress?source=recommendations

https://learn.microsoft.com/en-us/azure/aks/app-routing

https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/

If you have any further queries, please do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it" as it can be helpful to others in the community. User's image

Jiawang Liu 0 Reputation points

2024-10-22T05:28:42.7566667+00:00

Hi @Anusree Nashetty Actually, We are using azure app-routing addon(nginx-ingress), and we want use istio service mesh addon to protect traffic using mTLS between micorservice and ingress to microservice.

we follow the document https://docs.nginx.com/nginx-ingress-controller/tutorials/nginx-ingress-istio/ and change ingress controller deployment for this, it's valid, but as you know, azure app-routing addon created by Azure CRD https://learn.microsoft.com/en-us/azure/aks/app-routing-nginx-configuration?tabs=azurecli#create-an-internal-nginx-ingress-controller-with-a-private-ip-address, Does is will broke some thing if we change the ingress deployment manually? And is there have another way to use istio service mesh and app-routing with mTLS?
Anusree Nashetty 4,785 Reputation points Microsoft External Staff Moderator

2024-10-22T08:50:41.2533333+00:00

Hi Jiawang Liu,

When using Azure's App Routing addon, the NGINX ingress controller is managed by Azure. This means Azure controls its configuration, updates, and deployment via CRDs. If you manually modify the NGINX deployment, Consequently, any manual modifications to the NGINX deployment may be reverted during updates or when the addon undergoes reconfiguration.

To implement mTLS between the NGINX ingress controller and microservices without disrupting Azure's management of the NGINX ingress:

Disable the Azure App Routing addon: This would stop Azure from managing the NGINX ingress. Manually deploy NGINX as your ingress controller. This gives you full control over the NGINX deployment and its compatibility with Istio.

Configure Istio ingress gateways to work alongside the NGINX ingress managed by Azure. Instead of altering the existing Azure NGINX deployment, keep it intact and deploy a separate Istio ingress gateway to manage traffic between services. You can use the mTLS feature of Istio to secure traffic between the Istio ingress gateway and your microservices, leaving Azure’s NGINX configuration untouched.

Please let us know if you have any further queries. I’m happy to assist you further.

Thank you.

Share via

AKS Istio Service Mesh and Ingress Controller(Istio gateway or NGINX)

0 additional answers

Your answer