Migrate the Istio add-on to Cloud Service Mesh

These steps are specific to installations that identified that the ingress gateway of the Istio on GKE was configured in their cluster. In this process Cloud Service Mesh version 1.18 is installed with the managed control plane.

Important: If you installed the bundled version of Istio that is included by default with the "GKE add-on", you must instead follow the steps in migrate the bundled Istio to Cloud Service Mesh.

Before you begin

• Migrating from the "Istio add-on" requires that you to use Cloud Service Mesh with the Google-managed control plane. Therefore, the Cloud Service Mesh In-cluster control plane is not a supported migration option.

• You must first review and ensure that you meet the requirements for upgrading.

• The commands on this page use the environment variables and migration script from the upgrade preparation step.

• It is important that you perform each step of this process in the specified order.

Overview

In general, the process for migrating from the "Istio add-on" to Cloud Service Mesh with the managed control plane includes:

1. Installing the Cloud Service Mesh managed control plane.
2. Using the migration script to configure the Cloud Service Mesh ingress gateway.

Migrate to Cloud Service Mesh version 1.18

You must follow the detailed instructions in the Cloud Service Mesh document "Migrating from Istio on GKE to Cloud Service Mesh". After you complete the installation and have migrated your workloads, return to this page to complete the remaining configuration steps.

1. Use the "Istio add-on migration instructions" to migrate your installation to Cloud Service Mesh with the Google-managed control plane.

   Key items to be aware of during that process:

   • If you are prompted that the custom envoy filters are not supported. Simply, choose "yes" to continue the migration. Example:

     Detected custom envoy filters are not supported by Cloud Service Mesh.
     Please remove these if possible
     NAMESPACE    NAME                                 AGE
     gke-system   allowconnect-cluster-local-gateway   26m
     Continue anyways? [y/N] Y
     

   • The migration instructions include the section Complete a successful migration, which performs steps to finalize your Cloud Service Mesh installation. Important: After performing those steps, you will no longer be able to rollback your changes.

   Istio add-on migration instructions: Migrating from Istio on GKE to Cloud Service Mesh

2. After you complete the migration steps and have Migrated your workload to Cloud Service Mesh, run the following commands to restart and label your ingress pods in the knative-serving namespace:

   1. Restart your ingress pods:

      kubectl rollout restart deployment autoscaler activator webhook -n knative-serving
      

   2. Add the istio: ingressgateway label:

      kubectl patch deployment ${INGRESS_NAME} --namespace ${INGRESS_NAMESPACE} --patch  '{"spec": {"template": {"metadata": {"labels": {"istio": "ingressgateway"}}}}}'
      

Configure Cloud Service Mesh Ingress

In this section, the migration script is used to set the release channel to asm-managed-rapid for the Cloud Service Mesh managed control plane.

Run the following command to start the migration script:

 ./migration-addon.sh \
 --asm-revision asm-managed-rapid \
 --command set-up-asm-ingress

What's next

Install the fleet component

Rollback

If you need to rollback the changes that you made through the steps above, you can:

• Use the migration script to delete the Cloud Service Mesh ingress.
• Rollback the installation of Cloud Service Mesh.

To rollback the installation and configuration of Cloud Service Mesh with the Google-managed control plane:

1. Run the following command to delete the Cloud Service Mesh ingress:

   ./migration-addon.sh --command rollback-set-up-asm-ingress
   

   The terminal output during the process looks similar to the following:

   Deleting Cloud Service Mesh ingress
   deployment.apps "istio-ingressgateway" deleted
   horizontalpodautoscaler.autoscaling "istio-ingressgateway" deleted
   role.rbac.authorization.k8s.io "istio-ingressgateway-sds" deleted
   rolebinding.rbac.authorization.k8s.io "istio-ingressgateway-sds" deleted
   Cloud Service Mesh ingress is successfully deleted.
   

2. To verify the rollback, check that the istio-ingressgateway service no longer exists in the gke-system namespace:

   kubectl get deployment istio-ingressgateway -n gke-system
   

3. Rollback Cloud Service Mesh installation

4. Run the following command to re-enable the "Istio add-on":

   ./migration-addon.sh --command rollback-uninstall-istio-addon
   

5. To continue rolling back your changes to your installation's original state, rollback the Istio add-on.