Service Meshes

Service meshes take over and operate on all networking functions in your cluster. They route traffic, add DNS entries, and set up firewall rules. Because of this, it can be tricky to get Telepresence's own connectivity and intercepting functionality to work with a service mesh.

This page has two sections. The Integrations section discusses the native Telepresence integration with the Istio service mesh. This service mesh should be easy to configure and should work out of the box for most use cases. The Workarounds section discusses how Telepresence can sometimes operate in a service mesh such as Linkerd with certain workarounds. In these cases, some functionality may be limited.

Integrations

Istio

To get started with Telepresence on Istio, all you have to do is configure your Helm values on installing so that istio is enabled:

This will enable the Istio integration, allowing for some native Istio features to be used by Telepresence.

Intercepting services with numeric ports

When intercepting a service that uses a numeric port instead of a symbolic port, Telepresence's init container will conflict with Istio's own init container. Instead of injecting an init container, when running in Istio, Telepresence will create a networking.istio.io/v1alpha3 Sidecar resource to configure Istio's own sidecar to direct traffic to the Telepresence agent.

For example, if you have a service that looks like:

And you intercept it:

Then Telepresence will create a sidecar to direct traffic to the agent port:

Sidecar conflicts

If you already have Sidecars that are selecting your service, then this may cause conflicts which Telepresence will error on.

Take the example workload from the previous section, but let's say you hadn't run telepresence intercept and had instead created a sidecar that selects your workload:

When you go intercept now, Telepresence will give you an error:

At this point, your best bet is to add a name to your port; that will prevent any conflicts with existing sidecar configs:

Workarounds

Linkerd

Getting started with Telepresence on Linkerd services is as simple as adding an annotation to your Deployment:

The local system and the Traffic Agent connect to the Traffic Manager using its gRPC API on port 8081. Telling Linkerd to skip that port allows the Traffic Agent sidecar to fully communicate with the Traffic Manager, and therefore the rest of the Telepresence system.

Deploy

Save and deploy the following YAML. Note the config.linkerd.io/skip-outbound-ports annotation in the metadata of the pod template.

Connect to Telepresence

Run telepresence connect to connect to the cluster. Then telepresence list should show the quote deployment as ready to intercept:

Run the intercept

Run telepresence intercept quote --port 8080:80 to direct traffic from the quote deployment to port 8080 on your local system. Assuming you have something listening on 8080, you should now be able to see your local service whenever attempting to access the quote service.