Note: Currently this plugin is still underdevelopment and is provided without any commercial support. You are encouraged to report problems via Issues in this repo. For the help with troubleshooting you can post to the "vcluster" channel in our Slack - https://slack.loft.sh/
Note: The configuration provided here is an example. Please review and update it to match your environment and use case.
Prerequisite for installation are the Istio CRDs installed in the host cluster where vcluster will be installed.
To install this plugin you need to pass the ./plugin.yaml file as additional source of Helm values during the installation. This is described in more detail in vcluster docs - https://www.vcluster.com/docs/plugins/overview#loading-and-installing-plugins-to-vcluster
For testing purposes you can refer to the plugin.yaml for the Istio resources like so: https://raw.githubusercontent.com/loft-sh/vcluster-generic-crd-sync-plugin/main/crds/istio/plugin.yaml.
Example installation command:
vcluster create -n vcluster vcluster -f https://raw.githubusercontent.com/loft-sh/vcluster-generic-crd-sync-plugin/main/crds/istio/plugin.yaml
Once installed, the plugin will copy the CRDs from the host cluster into vcluster based on the configuration. Currently the configuration includes sync mappings for the VirtualService, DestinationRule and Gateway CRDs.
Provided configuration supports only limited number of Istio features. The VirtualServices and DestinationRules are recognized only for the purpose of directing traffic from the Gateway into a sevice. The intra mesh communication is not currently unsupported. The workloads from the vcluster are connected to the host mesh, but they can not resolve VirtualServices from the vcluster correctly, and as such it will usually fallback to usual Kubernetes Service based communication.
If you would like to allow vcluster users to use Gateways from the host cluster, instead of letting them create Gateways, then you can use the plugin-host-gateways.yaml configuration file.
In this mode the Gateway CRD is not synced to the vcluster and the .spec.gateways values of the VirtualServices are not overwritten when syncing the resource to the host cluster. This will allow vcluster users to use a Gateway that exists in the host cluster, but they would have to know the name of the Gateway resource.
You can also set a specific Gateway to be used for all VirtualServices synced to the host by updating the configuration based on comments inside the plugin-host-gateways.yaml file (find a comment with instructions in the VirtualService mapping).
By default, vcluster modifies pod labels before scheduling a pod in the host cluster. If you want to allow the vcluster users to use the sidecar.istio.io/inject label to control sidecar injection for their pod then you need to (or uncomment in the plugin.yaml file) these helm values:
syncer:
extraArgs:
- "--sync-labels=sidecar.istio.io/inject"