Install Istio in self-hosted Fusion

Table of Contents

Prerequisites
Install Istio
Deploy Fusion

Istio is a service mesh that can help you manage traffic routing between Fusion services, enable security protocols such as Transport Layer Security (TLS), and enforce policies like rate limits, access controls, and quotas. A service mesh is also useful for monitoring service health and performance when paired with an observability tool like Grafana.

If you’re using Ray models for machine learning in Fusion or Lucidworks AI and you require in-cluster TLS, then Istio is also required.

This feature is only available in Fusion 5.9.12 and later versions of Fusion 5.9.

Prerequisites

A dedicated Kubernetes cluster for hosting Fusion, and admin privileges for that cluster.
A Kubernetes namespace in that cluster where you will install Fusion.
Helm version 3.0.0 or later.

Install Istio

Install Istio before deploying Fusion into your Kubernetes cluster. For more information, see Istio’s Getting Started and Install with Istioctl guides.

Install the istioctl command line utility:

$ curl -sL https://istio.io/downloadIstioctl | sh -

Add istioctl to your path, so you can run the utility directly from your command prompt or terminal. On Mac or Linux, run the following command:
```
 export PATH=$HOME/.istioctl/bin:$PATH
```
Perform a default installation of Istio using istioctl:
```
istioctl install
```
To check that Istio successfully installed, run the following command to check the build version:
```
istioctl bug-report version
```

Label the Fusion namespace with istio-injection=enabled:

kubectl label namespace FUSION_NAMESPACE istio-injection=enabled --overwrite

Check that the Fusion namespace has the Istio label applied:

kubectl get namespace -L istio-injection

In the response, ISTIO-INJECTION is set to enabled.

NAME                          STATUS   AGE     ISTIO-INJECTION
FUSION_NAMESPACE              Active   5m9s    enabled

Deploy Fusion

After installing Istio, deploy Fusion. Fusion will automatically integrate with the Istio control plane. This integration allows the Istio control plane to recognize the workloads within Fusion and manipulate network traffic between them, thereby enhancing the overall functionality and routing capabilities of the Fusion instance.