Travel Demo Tutorial on Kiali

Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Platform Setup

This tutorial assumes you have access to a Kubernetes cluster with Istio installed.

This tutorial is being updated and qualified using:

a Kind (Kubernetes in Docker) cluster with Helm-based Kiali install.
an OpenShift cluster with Kiali Operator install (qualification pending).

Tip

Platform-dependent tasks will be indicated with a special note like this.

Version pins will be recorded here as the tutorial is re-qualified. Use current stable releases of Kind, Istio, and Kiali unless noted otherwise.

Install Travel Demo

Mon, 01 Jan 0001 00:00:00 +0000

Deploy the Travel Demo

This demo application deploys several services grouped into three namespaces:

travel-control — business dashboard to configure traffic and view statistics
travel-portal — shop simulators that generate traffic
travel-agency — quote and pricing services

At this step, deploy the application without joining it to the service mesh. Sidecar injection is added in Join the Mesh.

Do not label the namespaces with istio-injection=enabled yet.

Kind

From the Kiali source repository, the Travel Demo install script creates the namespaces and deploys the manifests without enabling auto-injection:

Join the Mesh

Mon, 01 Jan 0001 00:00:00 +0000

Sidecar Proxies

The Travel Demo was deployed in the previous chapter without Istio sidecar proxies. These are Envoy proxies that can be injected into the application pods.

Without a sidecar, workloads do not connect to the Istio control plane and do not report mesh telemetry (metrics, access logs, or distributed traces).

Confirm in Kiali

As shown in Install Travel Demo, the demo namespaces appear on the Namespaces page with type - (Not part of the mesh):

Observe the Mesh

Mon, 01 Jan 0001 00:00:00 +0000

Enable Sidecars in All Workloads

An Istio sidecar proxy connects a workload to the control plane and enables service mesh functionality.

Sidecars automatically collect metrics, access logs, and distributed traces — a major observability benefit of the mesh.

In Join the Mesh we injected a sidecar only into the control workload. The rest of the Travel Demo still lacks full mesh visibility.

Step 1

Use the Traffic Graph to identify missing sidecars in the Travel Demo

Control the Mesh

Mon, 01 Jan 0001 00:00:00 +0000

This chapter uses Kiali wizards to configure Istio traffic management on the Travel Demo. Each section introduces a scenario, walks through the wizard, verifies the result in Kiali, and ends with guidance to update or delete the generated configuration.

In Observe the Mesh you explored telemetry and tracing. Here you change how traffic flows through the mesh.

Request Routing

The Travel Demo application has several portals deployed on the travel-portal namespace consuming the travels service deployed on the travel-agency namespace.

Secure the Mesh

Mon, 01 Jan 0001 00:00:00 +0000

Authorization Policies and Sidecars

Security is one of Istio’s main pillars.

The Istio Security High Level Architecture provides a comprehensive solution to design and implement multiple security scenarios.

In this tutorial we will show how Kiali can use telemetry information to create security policies for the workloads deployed in a given namespace.

Istio telemetry aggregates the ServiceAccount information used in workload communication. This information can be used to define authorization policies that deny and allow actions based on observed live traffic.

Uninstall Travel Demo

Mon, 01 Jan 0001 00:00:00 +0000

Remove components in reverse order of installation: the Travel Demo application, Kiali, Istio, and (on Kind) the cluster itself.

Uninstall the Travel Demo

Delete the demo namespaces:

kubectl delete namespace travel-agency
kubectl delete namespace travel-portal
kubectl delete namespace travel-control

Alternatively, delete the manifests first (this removes any Istio resources created in those namespaces during the tutorial):

kubectl delete -f <(curl -L https://raw.githubusercontent.com/kiali/demos/master/travels/travel_agency.yaml) -n travel-agency --ignore-not-found
kubectl delete -f <(curl -L https://raw.githubusercontent.com/kiali/demos/master/travels/travel_portal.yaml) -n travel-portal --ignore-not-found
kubectl delete -f <(curl -L https://raw.githubusercontent.com/kiali/demos/master/travels/travel_control.yaml) -n travel-control --ignore-not-found

kubectl delete namespace travel-agency
kubectl delete namespace travel-portal
kubectl delete namespace travel-control

OpenShift

If you used the Kiali Travel Demo install script, it can also remove OpenShift-specific resources (SecurityContextConstraints and NetworkAttachmentDefinitions):

./hack/istio/install-travel-agency-demo.sh -c oc -d true