Istio integration (#421)

This the very first step for fission to integrate with Istio, which is an open platform to connect, manage, and secure microservices. With Istio, users are able to monitor functions usage and trace requests latency through dashboards. For more information, please visit http://fission.io/docs/

controller/api.go

@@ -21,6 +21,7 @@ import (
 	"net/http"
 	"os"
 	"runtime/debug"
+	"strconv"
 	"strings"
 
 	"github.com/gorilla/handlers"
@@ -41,6 +42,8 @@ type (
 		storageServiceUrl string
 		builderManagerUrl string
 		workflowApiUrl    string
+		functionNamespace string
+		useIstio          bool
 	}
 
 	logDBConfig struct {
@@ -74,6 +77,21 @@ func MakeAPI() (*API, error) {
 		api.workflowApiUrl = "http://workflows-apiserver"
 	}
 
+	fnNs := os.Getenv("FISSION_FUNCTION_NAMESPACE")
+	if len(fnNs) > 0 {
+		api.functionNamespace = fnNs
+	} else {
+		api.functionNamespace = "fission-function"
+	}
+
+	if len(os.Getenv("ENABLE_ISTIO")) > 0 {
+		istio, err := strconv.ParseBool(os.Getenv("ENABLE_ISTIO"))
+		if err != nil {
+			log.Println("Failed to parse ENABLE_ISTIO")
+		}
+		api.useIstio = istio
+	}
+
 	return api, err
 }
 

controller/functionApi.go

@@ -29,14 +29,22 @@ import (
 	"github.com/gorilla/mux"
 	log "github.com/sirupsen/logrus"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/client-go/pkg/api"
-	"k8s.io/client-go/pkg/api/v1"
+	apiv1 "k8s.io/client-go/pkg/api/v1"
 	restclient "k8s.io/client-go/rest"
 
 	"github.com/fission/fission"
 	"github.com/fission/fission/crd"
 )
 
+func (a *API) getIstioServiceLabels(fnName string) map[string]string {
+	return map[string]string{
+		"functionName": fnName,
+	}
+}
+
 func (a *API) FunctionApiList(w http.ResponseWriter, r *http.Request) {
 	funcs, err := a.fissionClient.Functions(metav1.NamespaceAll).List(metav1.ListOptions{})
 	if err != nil {
@@ -85,6 +93,62 @@ func (a *API) FunctionApiCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Since istio only allows accessing pod through k8s service,
+	// for the functions with executor type "poolmgr" we need to
+	// create a service for sending requests to pod in pool.
+	// Functions with executor type "Newdeploy" is specialized at
+	// pod starts. In this case, just ignore such functions.
+	fnExecutorType := f.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType
+
+	if a.useIstio && fnExecutorType == fission.ExecutorTypePoolmgr {
+		// create a same name service for function
+		// since istio only allows the traffic to service
+
+		sel := map[string]string{
+			"functionName": fnew.Metadata.Name,
+			"functionUid":  string(fnew.Metadata.UID),
+		}
+
+		// service for accepting user traffic
+		svc := apiv1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: a.functionNamespace,
+				Name:      fission.GetFunctionIstioServiceName(f.Metadata.Name, f.Metadata.Namespace),
+				Labels:    a.getIstioServiceLabels(f.Metadata.Name),
+			},
+			Spec: apiv1.ServiceSpec{
+				Type: apiv1.ServiceTypeClusterIP,
+				Ports: []apiv1.ServicePort{
+					// Service port name should begin with a recognized prefix, or the traffic will be
+					// treated as TCP traffic. (https://istio.io/docs/setup/kubernetes/sidecar-injection.html)
+					// Originally the ports' name are similar to "http-fetch" and "http-specialize".
+					// But for istio 0.5.1, istio-proxy return unexpected 431 error with such naming.
+					// https://github.com/istio/istio/issues/928
+					// Workaround: remove prefix
+					// TODO: prepend prefix once the bug fixed
+					{
+						Name:       "fetch",
+						Protocol:   apiv1.ProtocolTCP,
+						Port:       8000,
+						TargetPort: intstr.FromInt(8000),
+					},
+					{
+						Name:       "specialize",
+						Protocol:   apiv1.ProtocolTCP,
+						Port:       8888,
+						TargetPort: intstr.FromInt(8888),
+					},
+				},
+				Selector: sel,
+			},
+		}
+		_, err = a.kubernetesClient.CoreV1().Services(a.functionNamespace).Create(&svc)
+		if err != nil {
+			a.respondWithError(w, err)
+			return
+		}
+	}
+
 	w.WriteHeader(http.StatusCreated)
 	a.respondWithSuccess(w, resp)
 }
@@ -162,6 +226,20 @@ func (a *API) FunctionApiDelete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if a.useIstio {
+		// delete all istio services belong to the function
+		sel := a.getIstioServiceLabels(name)
+		svcList, err := a.kubernetesClient.CoreV1().Services(a.functionNamespace).List(metav1.ListOptions{
+			LabelSelector: labels.Set(sel).AsSelector().String(),
+		})
+		for _, svc := range svcList.Items {
+			err = a.kubernetesClient.CoreV1().Services(a.functionNamespace).Delete(svc.ObjectMeta.Name, &metav1.DeleteOptions{})
+			// log error and continue
+			log.Printf("Failed to delete service %v: %v", svc.ObjectMeta.Name, err)
+			continue
+		}
+	}
+
 	a.respondWithSuccess(w, []byte(""))
 }
 
@@ -219,7 +297,7 @@ func (a *API) FunctionPodLogs(w http.ResponseWriter, r *http.Request) {
 
 	// Get function Pods first
 	selector := "functionName=" + fnName
-	podList, err := a.kubernetesClient.Core().Pods(ns).List(metav1.ListOptions{LabelSelector: selector})
+	podList, err := a.kubernetesClient.CoreV1().Pods(ns).List(metav1.ListOptions{LabelSelector: selector})
 	if err != nil {
 		a.respondWithError(w, err)
 		return
@@ -233,10 +311,10 @@ func (a *API) FunctionPodLogs(w http.ResponseWriter, r *http.Request) {
 		return itime.After(jtime)
 	})
 
-	podLogOpts := v1.PodLogOptions{Container: envName} // Only the env container, not fetcher
+	podLogOpts := apiv1.PodLogOptions{Container: envName} // Only the env container, not fetcher
 	var podLogsReq *restclient.Request
 	if len(pods) > 0 {
-		podLogsReq = a.kubernetesClient.Core().Pods(ns).GetLogs(pods[0].ObjectMeta.Name, &podLogOpts)
+		podLogsReq = a.kubernetesClient.CoreV1().Pods(ns).GetLogs(pods[0].ObjectMeta.Name, &podLogOpts)
 	} else {
 		a.respondWithError(w, errors.New("No active pods found"))
 		return