
Before you begin
- Labs create a Google Cloud project and resources for a fixed time
- Labs have a time limit and no pause feature. If you end the lab, you'll have to restart from the beginning.
- On the top left of your screen, click Start lab to begin
Install Cloud Service Mesh
/ 50
Deploying a BookInfo application
/ 50
Istio is an open source framework for connecting, securing, and managing microservices. It can be used with any services, including but not limited to services that are hosted in a Kubernetes cluster. Istio lets you create a network of deployed services with load balancing, service-to-service authentication, monitoring, and more, without requiring any changes in service code.
As one example - in reliable distributed systems, it's common for a system to want to retry a request after a failure, possibly with an exponential backoff delay. There are libraries for Java, Golang and NodeJS that do this. However, employing them within the app means each different app will need to solve that problem independently. The Istio sidecar could do this for the app, automatically.
Cloud Service Mesh (ASM) is powered by Istio. With Cloud Service Mesh, you get an Anthos tested, fully supported, distribution of Istio, letting you create and deploy a service mesh with Anthos GKE, whether your cluster is operating in Google Cloud or on-premises.
You can use included configuration profiles with recommended settings customized for either Google Kubernetes Engine or Anthos GKE on-prem.
Finally, Cloud Service Mesh has a suite of additional features and tools that help you observe and manage secure, reliable services in a unified way:
Cloud Service Mesh is the easiest and richest way to implement an Istio-based service mesh on your Anthos clusters.
In this lab, you will install Cloud Service Mesh on a GKE cluster.
In this lab, you will learn how to perform the following tasks:
Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.
This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.
To complete this lab, you need:
Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the left is the Lab Details pane with the following:
Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).
The lab spins up resources, and then opens another tab that shows the Sign in page.
Tip: Arrange the tabs in separate windows, side-by-side.
If necessary, copy the Username below and paste it into the Sign in dialog.
You can also find the Username in the Lab Details pane.
Click Next.
Copy the Password below and paste it into the Welcome dialog.
You can also find the Password in the Lab Details pane.
Click Next.
Click through the subsequent pages:
After a few moments, the Google Cloud console opens in this tab.
Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.
Click Activate Cloud Shell at the top of the Google Cloud console.
Click through the following windows:
When you are connected, you are already authenticated, and the project is set to your Project_ID,
gcloud
is the command-line tool for Google Cloud. It comes pre-installed on Cloud Shell and supports tab-completion.
Output:
Output:
gcloud
, in Google Cloud, refer to the gcloud CLI overview guide.
In Cloud Shell, verify your default account is configured.
Verify that the Cloud SDK is configured to use your Qwiklabs-generated user account.
Output:
Update project configuration if needed.
If the SDK does not have the default project set correctly, update the configuration. Replace [project_id]
with the name of the project provided in the credential section of the Qwiklabs instructions page:
Output:
central
:Output:
It will take several minutes for cluster creation to complete.
cluster-admin
role on your cluster:Google provides a tool, asmcli
, which allows you to install or upgrade Cloud Service Mesh. If you let it, asmcli
will configure your project and cluster as follows:
You will use asmcli
to install Cloud Service Mesh on your cluster.
You can run asmcli validate
to make sure that your project and cluster are set up as required to install Cloud Service Mesh. With this option, asmcli
doesn't make any changes to your project or cluster, and it doesn't install Cloud Service Mesh.
asmcli validates that:
asm
package to the OUTPUT_DIR directory:On success, you should have output similar to the following:
The following command will install Cloud Service Mesh. The --enable_all flag allows the script to enable the required Google APIs, set Identity and Access Management permissions, and make the required updates to your cluster, which includes enabling GKE Workload Identity.
You should see output similar to the following:
Click Check my progress to verify the objective.
Cloud Service Mesh gives you the option to deploy and manage gateways as part of your service mesh. A gateway describes a load balancer operating at the edge of the mesh receiving incoming or outgoing HTTP/TCP connections. Gateways are Envoy proxies that provide you with fine-grained control over traffic entering and leaving the mesh.
Enable auto-injection on the gateway by applying a revision label on the gateway namespace. The revision label is used by the sidecar injector webhook to associate injected proxies with a particular control plane revision.
istiod
:Change to the directory that you specified in --output_dir
:
samples/gateways/istio-ingressgateway/
directory as is, or modify it as needed:Cloud Service Mesh uses sidecar proxies to enhance network security, reliability, and observability. With Cloud Service Mesh, these functions are abstracted away from an application's primary container and implemented in a common out-of-process proxy delivered as a separate container in the same Pod.
Before you deploy workloads, make sure to configure sidecar proxy injection so that Cloud Service Mesh can monitor and secure traffic.
To enable auto-injection, apply the revision label and remove the istio-injection label if it exists.
In the following command, you specify the namespace, default, where you want to enable auto-injection, and REVISION is the revision label you noted in the previous step:
"istio-injection" not found
in the output. That means that the namespace didn't previously have the istio-injection label, which you should expect in new installations of Cloud Service Mesh or new deployments. If this cluster had already been running workloads, you would need to restart the pods to re-trigger auto injection.
In this task, you will set up the Bookinfo sample microservices application and explore the app.
Now that ASM is configured and verified, you can deploy one of the sample applications provided with the installation — BookInfo. This is a simple mock bookstore application made up of four microservices - all managed using Istio. Each microservice is written in a different language, to demonstrate how you can use Istio in a multi-language environment, without any changes to code.
The microservices are:
There are 3 versions of the reviews microservice:
The end-to-end architecture of the application looks like this:
You can find the source code and all the other files used in this example in the Istio samples/bookinfo directory.
Look at the .yaml
which describes the bookInfo application:
Look for containers
to see that each deployment has one container, for each version of each service in the Bookinfo application.
In Cloud Shell, use the following command to inject
the proxy sidecar along with each application Pod that is deployed:
Istio uses an extended version of the open-source Envoy proxy, a high-performance proxy developed in C++, to mediate all inbound and outbound traffic for all services in the service mesh.
Istio leverages Envoy's many built-in features including dynamic service discovery, load balancing, TLS termination, HTTP/2 & gRPC proxying, circuit breakers, health checks, staged rollouts with %-based traffic split, fault injection, and rich metrics.Output:
Click Check my progress to verify the objective.
Now that the Bookinfo services are up and running, you need to make the application accessible from outside of your Kubernetes cluster, e.g. from a browser. An Istio Gateway is used for this purpose.
Look at the .yaml
which describes the configuration for the application ingress gateway:
Look for the Gateway
and VirtualService
mesh resources which get deployed. The Gateway
exposes services to users outside the service mesh, and allows Istio features such as monitoring and route rules to be applied to traffic entering the cluster.
Configure the ingress gateway for the application, which exposes an external IP you will use later:
Output:
Confirm that the application has been deployed correctly, review services, pods, and the ingress gateway:
Output:
Review running application pods:
Output:
You may need to re-run this command until you see that all six pods are in Running status.
Confirm that the Bookinfo application is running by sending a curl
request to it from some Pod, within the cluster, for example from ratings
:
Output:
Confirm the ingress gateway has been created:
Output:
Get the external IP address of the ingress gateway:
Output:
In this example, the external IP of the ingress gateway is 34.72.220.30
.
Now run the following command, replacing [EXTERNAL-IP]
with the external IP that was outputted from the previous command:
Check that the Bookinfo app is running by sending a curl
request to it from outside the cluster:
Output:
Point your browser to http://[$GATEWAY_URL]/productpage
to see the BookInfo web page. Don't forget to replace [$GATEWAY_URL]
with your working external IP address.
Refresh the page several times.
Notice how you see three different versions of reviews, since we have not yet used Istio to control the version routing.
There are three different book review services being called in a round-robin style:
Switching among the three is normal Kubernetes routing/balancing behavior.
Run the siege utility to simulate traffic to Bookinfo.
In Cloud Shell, install siege:
Siege is a utility for generating load against Web sites.
Use siege to create traffic against your services:
If prompted, click Enable to enable the Anthos API.
On the bottom half of the window, you will see a Service section.
How many services are listed?
Click on the productpage service to drill down and see more details.
Note the summary at the top detailing current requests/second, error rates, latencies, and resource usage.
If you don't see Requests > 0, try exiting and re-entering the productpage service after a few minutes.
On the left side of the window, click on the Metrics option. Explore the different graphs and their breakdown options.
Click on the Connected Services option from the left side.
This lists other services that make inbound requests of the productpage, and services the productpage makes outbound requests to.
Return to the Cloud Service Mesh dashboard by clicking on the Cloud Service Mesh logo in the upper left corner.
At this time, you can explore or drill down on other services.
The top section of the dashboard shows information about Service Level Objectives (SLOs) and Alerts.
SLOs are targets for Service Level Indicators (SLIs); they embody your definition of how well a service should perform. An example SLO would be 99.9% of hourly requests return a 200 response. You might define an alerting policy that pages on-call staff when your service is failing to meet its SLOs.
Look for other labs where you can define and test SLOs!On the Cloud Service Mesh dashboard, view the topology on the right side of the window.
Here you may need to wait a few minutes for the topology graph to appear.
Rearrange the nodes in the graph until you can easily visualize the relationships between services and workloads.
Remember, external requests start at productpage. You can scroll back and study the Bookinfo architecture diagram at the Bookinfo Overview.
Your drawing might look something like this:
Click on the productpage service node.
You should see a service details card:
Now, hover over each of the service nodes and notice edge stats.
You should see traffic details like this:
Drill down on one of the workloads until you can see the deployment, the replica set, and the Pods.
It should look something like this:
In this lab, you deployed a GKE cluster, Cloud Service Mesh, and an Istio-enabled application. You also used the Cloud Service Mesh dashboard to better understand the service performance and topology of your application.
...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.
Manual Last Updated August 6, 2024
Lab Last Tested August 6, 2024
Copyright 2025 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.
This content is not currently available
We will notify you via email when it becomes available
Great!
We will contact you via email if it becomes available
One lab at a time
Confirm to end all existing labs and start this one