How to set up multi-cluster Istio on AWS EKS

In this episode, Peter will talk to Sanjeev Ganjihal, Sr. Specialist Solutions Architect for Containers at AWS, about setting up production-ready Istio using a multi-primary and multi-network configuration across multiple Amazon EKS clusters.

[@MrKofiray71]

Excellent demo, team! This must be the best demonstration of running Istio on EKS. The provided Terraform code works flawlessly, and the tutorials are outstanding. Well done!

[@SanjeevTheTechNinja]

thank you

[@SakhileDlamini]

Some points from my recent experience. There is a very big cost management aspect of the set up that you did not cover, which is understandable. 1. When you have multiple, thousands of applications, in the cluster, the cost of data transfer for the envoy configs can be crazy. We used sidecars to limit the amount of data that gets shared. The cost for use was cross zone data transfer. 2. On multi-cluster networks the API Servers talk to each other, and if you have cloudwatch logs enabled, this can also increase the operational cost. I am investigating to move these logs to S3 instead. 3) I recently had an issue in production when using self-signed certificate where the ingress was failing with an error that says I am using certificates self-signed certificates. This error never came up in dev or staging cluster, it only happened in production. I am looking into moving to use Vault or KMS and cert manager. My preference would have been to suppress this error for now and do the cert-manager setup later. 4) I also would like to explore the canary upgrades for the control plan to safer deployments. Istio can cause a big headache when stuff breaks in production.

[@chiragchoudha9585]

can we use private link to run multi cluster istio ?

[@SanjeevTheTechNinja]

private link is used to establish connectivity between VPCs and AWS services without exposing data to the internet. If you want to establish VPC-VPC connectivity then yes and you could use private link