{"id":1936,"date":"2024-03-04T09:13:25","date_gmt":"2024-03-04T09:13:25","guid":{"rendered":"https:\/\/imesh.ai\/blog\/?p=1936"},"modified":"2024-03-07T05:07:01","modified_gmt":"2024-03-07T05:07:01","slug":"istio-multi-primary-installation-eks-and-aks","status":"publish","type":"post","link":"https:\/\/imesh.ai\/blog\/istio-multi-primary-installation-eks-and-aks\/","title":{"rendered":"How to setup multi-primary Istio in EKS and AKS for production"},"content":{"rendered":"\n

Introduction<\/h2>\n\n\n\n

Many large enterprises like retail and banks are adopting open-source Istio service mesh to abstract and better manage the security and network of microservices. To either tackle cost, achieve HA\/DR, or improve latency, they apply multicloud and multi-cluster strategies in their production system.<\/p>\n\n\n\n

Implementing Istio in multicloud environment can be tricky, and architects often take time for experimentation. In this blog, we will discuss various ways to achieve multicloud and multicluster configuration for Istio implementation and also guide you through the steps to set up primary-primary multicluster Istio in EKS and AKS<\/p>\n\n\n\n

Multicluster Istio deployment models<\/h2>\n\n\n\n

Istio can be configured by deploying it into single or multiple clusters, same or different networks, single or multiple control planes, or single or multiple meshes. To achieve HA\/DR or improve latency, Istio is deployed into multiple clusters. There are four popular deployment models for deploying Istio to attain HA\/DR and make seamless service discoverability in your production systems. <\/p>\n\n\n\n

Istio Deployment models<\/h3>\n\n\n\n
    \n
  1. Primary-remote<\/strong> on the same network<\/strong>: One Istio control plane is deployed in one or more cluster(s) (or called Primary) and serves as a master. All other clusters (referred to as Remote) can be brought under the control of master Istio.<\/li>\n\n\n\n
  2. Primary-remote on different networks<\/strong>: Primary-Remote setup with clusters in a different network, i.e., different zone or multicloud.<\/li>\n\n\n\n
  3. Multi-primary on the same network<\/strong>: Each cluster in the production system will have one Istio control plane, but they will all be connected and aware of each other. Note that there can be multiple remote clusters for each primary cluster. Refer to Fig A.<\/li>\n\n\n\n
  4. Multi-primary<\/strong> on different networks<\/strong>: Multi-primary setup for clusters in different zones\/regions or multicloud clusters. <\/li>\n<\/ol>\n\n\n
    \n
    \"Istio<\/figure>\n<\/div>\n\n\n

    Fig A: Depiction of Istio configured in both Primary-primary and Primary-remote style. <\/strong><\/p>\n\n\n\n

    We had discussed setting up Istio in the Primary-remote cluster in GKE and AKS<\/a> earlier. In this blog, we will focus on the Multi-Primary Istio setup. <\/p>\n\n\n\n

    Architecture to set up Multi-primary Istio in multicluster landscape<\/h3>\n\n\n\n

    The way to achieve multi-primary Istio setup is to install Istio control planes in each cluster (as shown in Fig B) and then have these clusters access to the API server of each other. Thus, there will be a single service mesh (although different Istio control planes), and the service discovery will be seamless in the mesh. The Istio control planes don\u2019t interfere with each other, so the failure of one Istio control plane will not affect other primary clusters. <\/p>\n\n\n

    \n
    \"\"<\/figure>\n<\/div>\n\n\n

    Fig B: Multi-primary Istio set up in AKS and EKS.<\/strong><\/p>\n\n\n\n

    Benefits of Multi-primary Istio<\/h3>\n\n\n\n

    Key benefits of setting up multi-primary Istio are:<\/p>\n\n\n\n

      \n
    • Improved availability: If a control plane fails, the damage will be limited to workloads or data plane managed by that control plane.<\/li>\n\n\n\n
    • Configuration isolation: Configuration can be made to one cluster, zone, or region without impacting others.<\/li>\n\n\n\n
    • Canary or blue\/green deployment: You have more fine-grained control over configuration rollout, such as canary or blue\/green, by deploying them into a sub-section of the mesh only.<\/li>\n\n\n\n
    • Controlled visibility and access with RBAC: Since all the services in multiple clusters can brought under one mesh with a multi-primary setup, you can implement fine-grained authorization for the developer and DevOps team worldwide. You can define the least privilege for access to a particular cluster or service in the whole mesh from a central point. Note that you have to create and deploy authorization policies in each primary cluster, which will be applied by the master control plane. <\/li>\n<\/ul>\n\n\n\n

      Steps to configure multi-primary Istio in EKS and AKS<\/h2>\n\n\n\n

      We will discuss a step-by-step guide to configure multi-primary Istio in this section. If you are interested, you can watch the complete video:<\/p>\n\n\n\n

      \n