独家优惠奖金 100% 高达 1 BTC + 180 免费旋转

How to set up JHipster microservices with Istio service mesh on Kubernetes

If you are still wondering, what the heck is a service mesh or Istio? then let's have an overview of Istio.

Istio provides the following functionality in a distributed application architecture:

Below is the architecture of Istio.

It can be classified into 2 distinct planes.

Control plane: It uses Pilot to manages and configure the proxies to route traffic. It also configures Mixer to enforce policies and to collect telemetry. It also has other components like Citadel, to manage security, and Galley, to manage configurations.

I hope this provides an overview of Istio, now let's focus on the goal of this article.

You can watch the video to see JHipster + Istio in action.

You can watch the slides on Speaker Deck as well.

First, let us prepare a Kubernetes cluster to deploy Istio and our application containers. Follow the instructions for any one of the platforms you prefer.

First let us create a resource group. You can use any region you like here instead of East US.

Create the Kubernetes cluster:

The node-count flag is important as the setup requires at least four nodes with the default CPU to run everything. You can try to use a higher kubernetes-version if it is supported, else stick to 1.11.4

The cluster creation could take while so sit back and relax. 🍹

Once the cluster is created, fetch its credentials to be used from kubectl by running the below command. It automatically injects the credentials to your kubectl configuration under ~/.kube/config

You can view the created cluster in the Azure portal:

Run kubectl get nodes to see it in the command line and to verify that kubectl can connect to your cluster.

Proceed to the Install and setup Istio section.

First, we need a GCP project, you can either use an existing project that you have or create a new one using GCloud CLI with below command:

Set the project you want to use as the default project:

Now let us create a cluster for our application with the below command:

The num-nodes and machine-type flags are important as the setup requires at least four nodes with a bigger CPU to run everything. You can try to use a higher cluster-version if it is supported, else stick to 1.10.

The cluster creation could take while so sit back and relax.

Once the cluster is created, fetch its credentials to be used from kubectl by running the below command. It automatically injects the credentials to your kubectl configuration under ~/.kube/config

You can view the created cluster in the GCP GUI.

Run kubectl get nodes to see it in the command line and to verify that kubectl can connect to your cluster.

Install Istio on your machine by following these steps:

Make sure to use version 1.0.2 since the latest version seems to have issues connecting to the MySQL database containers.

Now let us install Istio on our Kubernetes cluster by applying the provided Kubernetes manifests and helm templates from Istio.

Wait for the pods to run, these will be deployed to the istio-system namespace.

Once the pods are in running status, exit the watch loop and run the below to get the Ingress gateway service details. This is the only service that is exposed to an external IP.

The external IP is very important here, let us save this to an environment variable so that we can use it in further commands.

Now our Kubernetes cluster is ready for Istio. 🎉

In one of my previous posts, I showcased how to create a full stack microservice architecture using JHipster and JDL. You can read the post here if you want to learn more details about it. For this exercise, we will use the same application but we will not use the Eureka service discovery option we used earlier. Also, note that the store application is further split into Gateway and Product applications.

Here is the architecture of the microservice that we are going to create and deploy today.

It has a gateway application and three microservice applications. Each of them has its own database. You can see that each application has an Envoy proxy attached to the pod as a sidecar. Istio control plane components are also deployed to the same cluster along with Prometheus, Grafana, and Jaeger.

The Ingress gateway from Istio is the only entry point for traffic and it routes traffic to all microservices accordingly. Telemetry is collected from all the containers running in the cluster, including the applications, databases, and Istio components.

Compared to the architecture of the original application here, you can clearly see that we replaced the JHipster registry and Netflix OSS components with Istio. The ELK monitoring stack is replaced with Prometheus, Grafana and Jaeger configured by Istio. Here is the original architecture diagram without Istio for a quick visual comparison.

Let’s take a look at the modified JDL declaration. You can see that we have declared serviceDiscoveryType no here since we will be using Istio for that.

JHipster version 5.7.0 introduced support for deployment declaration straight in the JDL

We have the below in our JDL which declares our Kubernetes deployment:

The serviceDiscoveryType is disabled and we have enabled Istio with autoInjection support — the Envoy sidecars are injected automatically for the selected applications. Istio routes are also generated for the applications by enabling istioRoute option.

Now that our JDL is ready, let us scaffold our applications and Kubernetes manifests. Create a new directory and save the above JDL in the directory. Let us name it app-istio.jdl and then run the import-jdl command.

This will generate all the applications and install the required NPM dependencies in each of them. Once the applications are generated the deployment manifests will be generated and some useful instruction will be printed to the console.

Open the generated code in your favorite IDE/Editor and explore the code.

Now let us build and deploy our applications. Run the ./gradlew bootWar -Pprod jibDockerBuild command in the store, product, invoice, and notification folders to build the docker images. Once the images are built, push them to the docker repo with these commands:

Once the images are pushed, navigate into the generated Kubernetes directory and run the provided startup script. (If you are on windows you can run the steps in kubectl-apply.sh manually one by one.)

Run watch kubectl get pods -n jhipster to monitor the status.

Once all the pods are in running status we can explore the deployed applications

Istio setup includes Grafana and Prometheus configured to collect and show metrics from our containers. Let's take a look.

By default, only the Ingress gateway is exposed to external IP and hence we will use kubectl port forwarding to set up a secure tunnel to the required services

Let us create a tunnel for Grafana:

Open localhost:3000 to view the Grafana dashboard.

Grafana uses the metrics scrapped by Prometheus. We can look at Prometheus directly by creating a tunnel for it and opening localhost:9090:

Istio configures Jaeger for distributed tracing and service graph for service observability. Let us take a look at them.

Create a tunnel for Jaeger and open localhost:16686

You can make some requests in the application and find it in the tracing dashboard by querying for the service. Click on the request to see tracing details:

Let us now create a tunnel for the service graph and open it in localhost:8080/force/forcegraph.html:

Istio provides building blocks to build distributed microservices in a more Kubernetes-native way and takes the complexity and responsibility of maintaining those blocks away from you. This means you do not have to worry about maintaining the code or deployments for service discovery, tracing and so on.

Istio documentation says

Werner Vogels (CTO of AWS) quoted at AWS Re:Invent

Istio Service mesh helps with that statement. This lets you worry only about the applications that you are developing and with JHipster that future is truly here and you just need to worry about writing your business logic.

While this is great, it is not a silver bullet. Keep in mind that Istio is fairly new compared to other stable and battle-tested solutions like JHipster Registry (Eureka) or Consul.

Also, another thing to keep in mind is the resource requirements. The same microservices with JHipster Registry or Consul can be deployed to a 2 node cluster with 1 vCPU and 3.75 GB of memory per node in GCP while you need a 4 node cluster with 2 vCPUs and 7.5 GB of memory per node for Istio enabled deployments. The default Kubernetes manifest from Istio doesn’t apply any request limits for resources, and by adding and tuning those, the minimum requirement could be reduced. But still I don’t think you can get it as low as that is needed for the JHipster registry option.

In a real-world use case, the advantages of not having to maintain the complex parts of your infra vs having to pay for more resources might be a decision that has to be taken based on your priorities and goals.

JHipster provides a great Kubernetes setup to start with which you can further tweak as per your needs and platform. The Istio support is recent and will improve further over time, but it's still a great starting point especially to learn.

If you like this article, please leave some claps (Did you know that you can clap multiple times in Medium? 😁) I hope to write more about Istio in the near future.

My other related posts:

Add a comment

What is your view?

Send

Related posts:

Increase Productivity with Time Blocking

Increasing productivity has become the ultimate quest in the battle against procrastination and endless to-do lists. Fear not, for a secret weapon at your disposal: time blocking! This mighty…

Extend the shadow of the future

One of the six rules for improving the effectiveness of work from the book ‘Six Simple Rules’ is Extend the shadow of the future i.e. to ensure people have feedback cycles that provide them signals…

Billion Dollar Brokers Guide To Structure Your Day

Ryan Serhant is a renowned real estate broker that does billion-dollar deals daily. He is also a TV star that is featured on the hit TV show Million Dollar Listing. Yet this success didn’t just come…