GKEにIstioをインストールしてgRPCでSSL/TLS通信できるようにする

$ helm repo add istio.io https://storage.googleapis.com/istio-release/releases/1.4.0/charts/

$ helm search repo istio.io
NAME                    CHART VERSION   APP VERSION     DESCRIPTION
istio.io/istio          1.4.0           1.4.0           Helm chart for all istio components
istio.io/istio-cni      1.4.0           1.4.0           Helm chart for istio-cni components
istio.io/istio-init     1.4.0           1.4.0           Helm chart to initialize Istio CRDs

$ kubectl create namespace istio-system

$ helm install istio-init --namespace istio-system istio.io/istio-init --values kubernetes/istio/init-values.yaml

certmanager:
  enabled: true

helm install istio --namespace istio-system istio.io/istio --values kubernetes/istio/values.yaml

global:
  proxy:
    tracer: "stackdriver"

kiali:
  enabled: true
  createDemoSecret: true

grafana:
  enabled: true

certmanager:
  enabled: true

$ kubectl label namespace default istio-injection=enabled

FROM python:3-slim as base
FROM base as builder
RUN apt-get -qq update \
    && apt-get install -y --no-install-recommends \
        g++ \
    && rm -rf /var/lib/apt/lists/*

# Enable unbuffered logging
FROM base as final
ENV PYTHONUNBUFFERED=1

RUN apt-get -qq update \
    && apt-get install -y --no-install-recommends \
        wget

WORKDIR /helloserver

# Add the application
COPY . .

EXPOSE 8080
ENTRYPOINT [ "python", "server.py" ]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: helloserver
spec:
  selector:
    matchLabels:
      app: helloserver
  replicas: 1
  template:
    metadata:
      labels:
        app: helloserver
    spec:
      terminationGracePeriodSeconds: 5
      restartPolicy: Always
      containers:
      - name: main
        image: gcr.io/example/helloserver:1.0.0
        imagePullPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: hellosvc
spec:
  selector:
    app: helloserver
  ports:
  - name: http
    port: 80
    targetPort: 8080

$ docker build -t gcr.io/example/helloserver:1.0.0 .
$ docker push gcr.io/example/helloserver:1.0.0

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: example
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: example
  namespace: default
spec:
  gateways:
  - example
  hosts:
  - "*"
  http:
  - route:
    - destination:
        host: hellosvc
        port:
          number: 80

$ kubectl create secret generic -n istio-system cert-manager-service-account --from-file=key.json

apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: letsencrypt-production
  namespace: istio-system
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: account@example.com
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
    - selector: {}
      dns01:
        clouddns:
          project: example
          serviceAccountSecretRef:
            name: cert-manager-service-account
            key: key.json

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: example
  namespace: istio-system
spec:
  secretName: istio-ingressgateway-certs
  issuerRef:
    name: letsencrypt-production
  commonName: example.com
  dnsNames:
  - example.com

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: example
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "*"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: grpc-greeter-go
  namespace: default
spec:
  selector:
    matchLabels:
      app: grpc-greeter-go
  replicas: 1
  template:
    metadata:
      labels:
        app: grpc-greeter-go
    spec:
      terminationGracePeriodSeconds: 5
      restartPolicy: Always
      containers:
      - name: main
        image: gcr.io/example/grpc-greeter-go:1.0.0
        imagePullPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: grpc-greeter-go
  namespace: default
spec:
  selector:
    app: grpc-greeter-go
  ports:
  - name: grpc
    port: 80
    protocol: TCP
    targetPort: 50051

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: example
  namespace: default
spec:
  gateways:
  - example
  hosts:
  - "*"
  http:
  - route:
    - destination:
        host: grpc-greeter-go
        port:
          number: 80

config := &tls.Config{
  InsecureSkipVerify: true,
}
conn, err = grpc.Dial(*address, grpc.WithTransportCredentials(credentials.NewTLS(config)))

$ istioctl dashboard grafana

$ istioctl dashboard kiali