Static IP addressing in vSphere OCP cluster running Service Mesh

Posted on

I have an vSphere OpenShift environment running multiple applications that are in a Service Mesh/Istio deployment. I need to separate the ingress and egress traffic from certain applications and set certain ingress/egress points to specific static IP addresses (essentially, I need to ensure traffic traversing certain mesh ingress/egress gateways has a static external source/destination IP. Right now everything uses the default ingress-controller IP.

1.) How can I deploy additional ingress-controllers with separate virtual IPs for ingress to specific hosts?

  • i.e. 192.168.2.100 is the "default" ingress deployed during cluster creation, 192.168.2.101 is ingress 2 , 192.168.2.102 is ingress 3 etc. Each additional ingress would only be used for a specific application and incoming traffic source.

2) How can I configure my egress traffic from specific pods/hosts to leave the cluster on a specific external IP address? (i.e. traffic to Azure leaves service A from our cluster on IP 192.168.3.101. traffic to AWS leaves Service B from our cluster on IP 192.168.3.101.

Apologies if this is slightly nonsensical, OpenShift networking is not my strong suite. I realize the requirement for static IP addressing of ingress/egress traffic to/from certain workloads or mesh gateways may sound ridiculous but it's to support some hard security requirements.

bt

Responses