Service mesh configurations
Service meshes manage and control all networking functions within a cluster, including traffic routing, DNS resolution, and firewall rule configuration. Because of this, integrating the connectivity and interception capabilities of Blackbird cluster (powered by Telepresence) with a service mesh can be challenging. It's essential to properly configure your system to ensure compatibility and prevent conflicts.
Using this page, you can learn about:
Istio service mesh configurations
An Istio service mesh is an open-source service mesh that provides traffic management, security, and observability without requiring changes to application code. For most use cases, you can use it out of the box.
To get started, configure your Helm values so Istio is enabled.
Intercepting services with numeric ports
When intercepting a service that uses a numeric port instead of a symbolic port, Blackbird's initContainer will conflict with Istio's init container. Instead of injecting an init container when running in Istio, Blackbird creates a networking.istio.io/v1alpha3 sidecar resource to configure Istio's own sidecar to direct traffic to the Blackbird agent.
For example, if you have a service similar to the following:
And you intercept the service:
Blackbird creates a sidecar to direct traffic to the agent port:
Sidecar conflicts
If you have sidecar configurations that are selecting your service, they can cause conflicts that produce errors in Blackbird.
Using the example in the previous section, if you created a sidecar that selects your workload instead of running blackbird cluster intercept:
When you attempt to intercept, Blackbird will produce an error.
To resolve this, you can add a name to your port to prevent any conflicts with existing sidecar configs:
Linkerd service mesh configurations
A Linkerd service mesh is an open-source service mesh designed to manage, secure, and observe communication between microservices.
To get started with Linkerd, you can add an annotation to your deployment:
The local system and the Traffic Agent connect to the Traffic Manager using its gRPC API on port 8081. Configuring Linkerd to exclude that port allows the Traffic Agent sidecar to establish full communication with the Traffic Manager, enabling a seamless integration with the rest of Blackbird.
Deploy
Save and deploy the following YAML.
Note the config.linkerd.io/skip-outbound-ports annotation in the metadata of the Pod template:
Connect to the cluster
Run blackbird cluster connect to connect to the cluster. Then, run blackbird cluster list to show the quote deployment as ready to intercept:
Run the intercept
Run blackbird cluster intercept quote --port 8080:80 to direct traffic from the quote deployment to port 8080 on your local system. If a service is listening on port 8080, accessing the quote service should display your local service.