Istio exposes applications to the Internet

Because the domain name of the application is not specified , So it will go to the back end httpbin and nginx These two applications , That's not gonna work .

In the configuration gateway And virtual services , Inside hosts There is no clear definition of which service , It's all used * To express .

So this creates 3 individual 80 port , At the same time http Such a gateway.

So will istio Services on the grid , Expose to the outside of the cluster , Add load balancer in front , Then according to the domain name to shunt .

Expose applications to the Internet

---

In actual deployment ,K8s Clusters are generally deployed on the intranet , In order to expose to the Internet , A load balancer will be added in front （ Public cloud LB product 、Nginx、LVS etc. ）, For flow inlet , Pass the domain name accessed by the user to IngressGateway,IngressGateway Then forward to different applications .

When the request comes ingressgateway here , Let it use the domain name to divert , Forward to different applications .

Front-end LB Provide a unified entrance . Generally, it will not let the internal ingressgateway Exposed to the Internet , Because it's not safe . Therefore, a flow inlet will be added in front , Just like the gateway , To provide a unified gateway access .

proxy_set_header Send the domain name from the browser to ingress-gateway Inside . stay ingress-gateway It is forwarded to different back-end services .

This nginx All have public networks ip, Domain name resolves to nginx above .

You can see that different projects only need to resolve their domain names to the load balancer of the public network , Then on each virtual service ,gateway It says .