From d9e9f3721d07865af5a82dd5d38643bb481e435d Mon Sep 17 00:00:00 2001 From: Dylan Stephano-Shachter Date: Sun, 3 May 2026 14:55:50 +0000 Subject: [PATCH 1/4] Istio tutorial --- docs/tutorial/index.md | 1 + docs/tutorial/istio-migration.md | 77 ++++++++++++++++++++++++++++++++ docs/tutorial/istio-migration.sh | 22 +++++++++ 3 files changed, 100 insertions(+) create mode 100644 docs/tutorial/istio-migration.md create mode 100755 docs/tutorial/istio-migration.sh diff --git a/docs/tutorial/index.md b/docs/tutorial/index.md index 78af36c7..1b2474f3 100644 --- a/docs/tutorial/index.md +++ b/docs/tutorial/index.md @@ -26,6 +26,7 @@ Production deployment configuration may differ from the setup showcased here. :maxdepth: 1 COS on Canonical K8s +Migrate COS from traefik to istio ``` ## COS Lite diff --git a/docs/tutorial/istio-migration.md b/docs/tutorial/istio-migration.md new file mode 100644 index 00000000..9c5b0daa --- /dev/null +++ b/docs/tutorial/istio-migration.md @@ -0,0 +1,77 @@ +# Migrating from Traefik to Istio + +In this guide, you will learn how to migrate the Canonical Observability Stack from using Traefik as its ingress to +using Istio. Istio is a service mesh which allows you to secure and control all the network traffic on your cluster. +For more info on Istio, you can [browse the docs](https://canonical-service-mesh-documentation.readthedocs-hosted.com/latest/). + +## Prerequisites + +* [Kubernetes](https://documentation.ubuntu.com/canonical-kubernetes/latest/) +* [Juju](https://documentation.ubuntu.com/juju/) +* The [Canonical Observability Stack](https://link-to-cos-docs) + +```{note} +The Istio charms work with Microk8s out of box. If you are using Canonical Kubernetes, see [these instructions](https://canonical-service-mesh-documentation.readthedocs-hosted.com/latest/how-to/use-charmed-istio-with-canonical-kubernetes/). If you are using any other flavor of Kubernetes, see the [Istio docs](https://istio.io/latest/docs/setup/platform-setup/). +``` + +```{note} +COS 2 does not have support for service mesh. To use service mesh, you must deploy cos from track 3 or greater or from dev. +``` + +## Steps + +* Install Istio on the cluster + +```{code} bash +juju add-model istio-system +juju deploy istio-k8s istio --channel dev/edge --trust +``` +Once the charm settles, Your cluster is ready to use Istio. + +* Switch back to the cos model + +```{code} bash +juju switch cos +``` + +* Remove the Traefik charm + +```{code} bash +juju remove-application traefik +``` + +* Now we install the istio-beacon charm. By relating all of the COS apps to the beacon, we put them on the mesh so that their network traffic becomes controlled by Istio. + +```{code} bash +juju deploy istio-beacon-k8s istio-beacon --channel dev/edge --trust +juju integrate istio-beacon:service-mesh alertmanager +juju integrate istio-beacon:service-mesh catalogue +juju integrate istio-beacon:service-mesh grafana +juju integrate istio-beacon:service-mesh loki +juju integrate istio-beacon:service-mesh mimir +juju integrate istio-beacon:service-mesh otelcol +juju integrate istio-beacon:service-mesh tempo +``` +You will need to wait a while for the model to settle but it should all reach active/idle eventually. + +* Now all of our charms are on the mesh, but we still have no ingress set up. So we install the istio-ingress charm. + +```{code} bash +juju deploy istio-ingress-k8s istio-ingress --channel dev/edge --trust +juju relate istio-ingress:ingress alertmanager +juju relate istio-ingress:ingress catalogue +juju relate istio-ingress:ingress grafana +juju relate istio-ingress:ingress loki +juju relate istio-ingress:ingress mimir +juju relate istio-ingress:istio-ingress-route otelcol +juju relate istio-ingress:istio-ingress-route tempo +``` +Once again you will need to wait some time for this to settle. + +* Your migration is not complete. To make sure everything is working navigate to `http://\/cos-catalogue` and check that everything is still working. + +* To view all of the network policies created, view the authorization policies + +```{code} bash +kubectl get ap +``` diff --git a/docs/tutorial/istio-migration.sh b/docs/tutorial/istio-migration.sh new file mode 100755 index 00000000..b4a8ded8 --- /dev/null +++ b/docs/tutorial/istio-migration.sh @@ -0,0 +1,22 @@ +#!/usr/bin/env bash + +juju add-model istio-system +juju deploy istio-k8s istio --channel dev/edge --trust +juju switch cos +juju remove-application traefik +juju deploy istio-beacon-k8s istio-beacon --channel dev/edge --trust +juju integrate istio-beacon:service-mesh alertmanager +juju integrate istio-beacon:service-mesh catalogue +juju integrate istio-beacon:service-mesh grafana +juju integrate istio-beacon:service-mesh loki +juju integrate istio-beacon:service-mesh mimir +juju integrate istio-beacon:service-mesh otelcol +juju integrate istio-beacon:service-mesh tempo +juju deploy istio-ingress-k8s istio-ingress --channel dev/edge --trust +juju relate istio-ingress:ingress alertmanager +juju relate istio-ingress:ingress catalogue +juju relate istio-ingress:ingress grafana +juju relate istio-ingress:ingress loki +juju relate istio-ingress:ingress mimir +juju relate istio-ingress:istio-ingress-route otelcol +juju relate istio-ingress:istio-ingress-route tempo From 98804cf643061a4ba6584af9ee2a4fd840a4d895 Mon Sep 17 00:00:00 2001 From: Dylan Stephano-Shachter Date: Mon, 4 May 2026 09:36:17 +0000 Subject: [PATCH 2/4] forgot to add the link --- docs/tutorial/istio-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorial/istio-migration.md b/docs/tutorial/istio-migration.md index 9c5b0daa..75da6c15 100644 --- a/docs/tutorial/istio-migration.md +++ b/docs/tutorial/istio-migration.md @@ -8,7 +8,7 @@ For more info on Istio, you can [browse the docs](https://canonical-service-mesh * [Kubernetes](https://documentation.ubuntu.com/canonical-kubernetes/latest/) * [Juju](https://documentation.ubuntu.com/juju/) -* The [Canonical Observability Stack](https://link-to-cos-docs) +* The [Canonical Observability Stack](https://documentation.ubuntu.com/observability) ```{note} The Istio charms work with Microk8s out of box. If you are using Canonical Kubernetes, see [these instructions](https://canonical-service-mesh-documentation.readthedocs-hosted.com/latest/how-to/use-charmed-istio-with-canonical-kubernetes/). If you are using any other flavor of Kubernetes, see the [Istio docs](https://istio.io/latest/docs/setup/platform-setup/). From f6d9615dd3b85b29236eb681e36c1835d53a7d0d Mon Sep 17 00:00:00 2001 From: Dylan Stephano-Shachter Date: Tue, 5 May 2026 14:45:16 +0200 Subject: [PATCH 3/4] Update docs/tutorial/istio-migration.md Co-authored-by: Michael Thamm Signed-off-by: Dylan Stephano-Shachter --- docs/tutorial/istio-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorial/istio-migration.md b/docs/tutorial/istio-migration.md index 75da6c15..b675899c 100644 --- a/docs/tutorial/istio-migration.md +++ b/docs/tutorial/istio-migration.md @@ -1,4 +1,4 @@ -# Migrating from Traefik to Istio +# How to migrate from Traefik to Istio In this guide, you will learn how to migrate the Canonical Observability Stack from using Traefik as its ingress to using Istio. Istio is a service mesh which allows you to secure and control all the network traffic on your cluster. From 10f12b5a8a1e4a0ceab856567c45eb1ef183a55a Mon Sep 17 00:00:00 2001 From: Dylan Stephano-Shachter Date: Thu, 7 May 2026 06:46:13 +0000 Subject: [PATCH 4/4] Move to how-to --- docs/how-to/migrate/index.md | 1 + .../migrate}/istio-migration.md | 0 docs/tutorial/index.md | 1 - docs/tutorial/istio-migration.sh | 22 ------------------- 4 files changed, 1 insertion(+), 23 deletions(-) rename docs/{tutorial => how-to/migrate}/istio-migration.md (100%) delete mode 100755 docs/tutorial/istio-migration.sh diff --git a/docs/how-to/migrate/index.md b/docs/how-to/migrate/index.md index d4c6612a..f051aea0 100644 --- a/docs/how-to/migrate/index.md +++ b/docs/how-to/migrate/index.md @@ -12,6 +12,7 @@ Replace an older LMA deployment with the COS Lite stack. :maxdepth: 1 Migrate from LMA to COS Lite +Migrate from Traefik to Istio ``` ## Agent migration diff --git a/docs/tutorial/istio-migration.md b/docs/how-to/migrate/istio-migration.md similarity index 100% rename from docs/tutorial/istio-migration.md rename to docs/how-to/migrate/istio-migration.md diff --git a/docs/tutorial/index.md b/docs/tutorial/index.md index 1b2474f3..78af36c7 100644 --- a/docs/tutorial/index.md +++ b/docs/tutorial/index.md @@ -26,7 +26,6 @@ Production deployment configuration may differ from the setup showcased here. :maxdepth: 1 COS on Canonical K8s -Migrate COS from traefik to istio ``` ## COS Lite diff --git a/docs/tutorial/istio-migration.sh b/docs/tutorial/istio-migration.sh deleted file mode 100755 index b4a8ded8..00000000 --- a/docs/tutorial/istio-migration.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/usr/bin/env bash - -juju add-model istio-system -juju deploy istio-k8s istio --channel dev/edge --trust -juju switch cos -juju remove-application traefik -juju deploy istio-beacon-k8s istio-beacon --channel dev/edge --trust -juju integrate istio-beacon:service-mesh alertmanager -juju integrate istio-beacon:service-mesh catalogue -juju integrate istio-beacon:service-mesh grafana -juju integrate istio-beacon:service-mesh loki -juju integrate istio-beacon:service-mesh mimir -juju integrate istio-beacon:service-mesh otelcol -juju integrate istio-beacon:service-mesh tempo -juju deploy istio-ingress-k8s istio-ingress --channel dev/edge --trust -juju relate istio-ingress:ingress alertmanager -juju relate istio-ingress:ingress catalogue -juju relate istio-ingress:ingress grafana -juju relate istio-ingress:ingress loki -juju relate istio-ingress:ingress mimir -juju relate istio-ingress:istio-ingress-route otelcol -juju relate istio-ingress:istio-ingress-route tempo