Fission and Istio Integration

Tutorial for how to integrate Fission with Istio

ta-ching chen

3 minute read



Fission is a framework for serverless functions on Kubernetes. Istio is an open platform to connect, manage, and secure microservice announced by Google, IBM and Lyft. It makes sense to combine them together to provide user more powerful functionalities.

Since this is the very first step for fission to integrate with Istio, there are still couple problems need to be solved. For those interested in trying to integrate fission with istio, following is the set up tutorial.

Test Environment

  • Google Kubernetes Engine: 1.8.4-gke.0 alpha cluster

Set Up

Create Kubernetes v1.8+ alpha cluster

Enable both RBAC & initializer features on kubernetes cluster.

$ gcloud container clusters create istio-demo \
    --enable-kubernetes-alpha \
    --machine-type=n1-standard-2 \
    --num-nodes=1 \
    --no-enable-legacy-authorization \
    --zone=<ZONE> \

Grant cluster admin permissions

Grant admin permission for system:serviceaccount:kube-system:default and current user.

# for system:serviceaccount:kube-system:default
$ kubectl create clusterrolebinding --user system:serviceaccount:kube-system:default kube-system-cluster-admin --clusterrole cluster-admin

# for current user
$ kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user=$(gcloud config get-value core/account)

Set up Istio environment

Download Istio 0.2.12

curl -L | sh -

Apply istio related YAML files

$ kubectl apply -f istio-0.2.12/install/kubernetes/istio.yaml
$ kubectl apply -f istio-0.2.12/install/kubernetes/istio-initializer.yaml

Since helm uses jobs to install charts, we have to remove jobs from initializers.rules.resources due to a known issue in istio pilot as a workaround.

$ kubectl edit initializerconfigurations
- name:
  - apiGroups:
    - '*'
    - '*'
    - deployments
    - statefulsets
    # As a workaround right now, remove jobs here 
    # due to a known issue ( 
    - jobs
    - daemonsets

Set default namespace to fission

$ kubectl config set-context $(kubectl config current-context) --namespace=fission

Install fission

$ git clone
$ cd fission/charts && git checkout istio-integration

fission-bundle docker image for demo: life1347/fission-istio-integration:latest

$ helm init
$ helm install --debug --namespace fission --set enableIstio=true,image=life1347/fission-istio-integration,imageTag=latest,pullPolicy=Always --name istio-demo fission-all

Create and access custom function

Set environment

$ export FISSION_URL=http://$(kubectl --namespace fission get svc controller -o=jsonpath='{..ip}')
$ export FISSION_ROUTER=$(kubectl --namespace fission get svc router -o=jsonpath='{..ip}')

Nodejs hello function: hello.js

// hello.js
module.exports = async function(context) {
    return {
        status: 200,
        body: "Hello, World!\n"

Create environment

$ fission env create --name nodejs --image fission/node-env

Create function

$ fission fn create --name h1 --env nodejs --code hello.js --method GET

Create route

$ fission route create --method GET --url /h1 --function h1

Access function

$ curl http://$FISSION_ROUTER/h1
Hello, World!

Install Add-ons

  • Prometheus
$ kubectl apply -f istio-0.2.12/install/kubernetes/addons/prometheus.yaml
$ kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=prometheus -o jsonpath='{.items[0]}') 9090:9090

Web Link:

  • Grafana

Please install Prometheus first.


$ kubectl apply -f istio-0.2.12/install/kubernetes/addons/grafana.yaml
$ kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=grafana -o jsonpath='{.items[0]}') 3000:3000

Web Link:

  • Jaeger


$ kubectl apply -n istio-system -f
$ kubectl port-forward -n istio-system $(kubectl get pod -n istio-system -l app=jaeger -o jsonpath='{.items[0]}') 16686:16686

Web Link: http://localhost:16686


comments powered by Disqus