Admin
TECHNEWS

OCI

OCI OKE Production Deployment: Istio Service Mesh for Kubernetes

Master OKE production deployments with Istio service mesh. Get expert insights for scalable, secure Kubernetes apps on Oracle Cloud Infrastructure.

By Sujay SinghPublished: August 4, 202610 min read17 views✓ Fact Checked
OCI OKE Production Deployment: Istio Service Mesh for Kubernetes
OCI OKE Production Deployment: Istio Service Mesh for Kubernetes

Navigating the Cloud-Native Frontier: OCI Kubernetes Engine (OKE) Production Deployment with Istio Service Mesh

As enterprises increasingly embrace microservices architectures, the complexity of managing distributed applications grows exponentially. Orchestration tools like Kubernetes have become indispensable, but even Kubernetes, powerful as it is, requires additional layers for advanced traffic management, robust security, and deep observability across a sprawling microservices landscape. This is where a service mesh like Istio steps in, transforming a standard Kubernetes deployment into a highly resilient, secure, and observable platform.

In this article, we, at TechNews Venture, will delve into the powerful synergy of Oracle Cloud Infrastructure (OCI) Kubernetes Engine (OKE) and Istio. OKE provides a fully managed, scalable, and highly available Kubernetes service, while Istio adds a programmable infrastructure layer that makes it easy to connect, secure, control, and observe services. We'll guide you through a production-ready deployment, demonstrating how to leverage OCI's robust infrastructure alongside Istio's advanced capabilities to build a modern, enterprise-grade cloud-native platform.

Overview of OKE and Istio

OCI Kubernetes Engine (OKE) is a fully managed, highly available, and scalable service that you can use to deploy your containerized applications to the cloud. OKE takes the operational burden of running Kubernetes off your shoulders, managing the control plane, patching, and scaling. It integrates seamlessly with other OCI services like Virtual Cloud Network (VCN), Load Balancers, Identity and Access Management (IAM), and Object Storage, providing a comprehensive ecosystem for cloud-native workloads.

Istio is an open-source service mesh that layers transparently onto existing distributed applications. It provides a uniform way to integrate an array of capabilities across a microservice application, including:

  • Traffic Management: Fine-grained control over traffic flow with features like A/B testing, canary rollouts, traffic splitting, retries, timeouts, and circuit breakers.
  • Observability: Automatic metrics, logs, and traces for all service-to-service communication, integrated with tools like Prometheus, Grafana, and Kiali.
  • Security: Mutual TLS (mTLS) for all service communications, robust authorization policies, and secure naming.
  • Policy Enforcement: Apply policies for resource quotas, access control, and rate limiting.

Combining OKE with Istio creates a formidable platform for production deployments, offering the scalability and reliability of a managed Kubernetes service alongside the advanced operational capabilities of a service mesh. This synergy allows organizations to accelerate development cycles, enhance application resilience, and enforce consistent security policies across their microservices.

Prerequisites

Before embarking on our deployment journey, ensure you have the following prerequisites in place:

1. OCI Account and Permissions

  • An active OCI tenancy with sufficient credit or free tier access.
  • An OCI user with the necessary IAM policies to manage networking, OKE clusters, and related resources. Here's a sample policy statement for a group named oke_admins_group in a compartment named tech_news_prod_compartment:

Allow group oke_admins_group to manage vcns in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage vnics in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage subnets in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage security-lists in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage network-security-groups in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage route-tables in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage internet-gateways in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage nat-gateways in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage service-gateways in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage instance-pools in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage instance-configurations in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage instances in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage volume-attachments in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage boot-volumes in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage volumes in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage cluster-family in compartment tech_news_prod_compartment
Allow group oke_admins_group to manage all-resources in compartment tech_news_prod_compartment where target.resource.type = 'cluster'
Allow group oke_admins_group to manage all-resources in compartment tech_news_prod_compartment where target.resource.type = 'nodepool'
Allow group oke_admins_group to use load-balancers in compartment tech_news_prod_compartment
Allow group oke_admins_group to use ons-topics in compartment tech_news_prod_compartment
Allow group oke_admins_group to use metrics in compartment tech_news_prod_compartment
Allow group oke_admins_group to read compartments in tenancy

2. Tools Installation

  • OCI CLI: Installed and configured. Ensure you can run oci --version and interact with your tenancy. 
    
bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)"
oci setup config
  • kubectl: The Kubernetes command-line tool. 
    
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/
  • Helm: The Kubernetes package manager. 
    
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
  • Istioctl: The Istio command-line tool. We'll download it during the Istio installation step.

3. Network Configuration Plan

For a production OKE deployment, it's crucial to segregate network components. We'll define a VCN with specific subnets:

  • VCN Name: tech-news-prod-vcn
  • VCN CIDR: 10.0.0.0/16
  • Subnets:
    • OKE API Endpoint Subnet (Private): tech-news-oke-api-subnet (10.0.1.0/24) - For the Kubernetes API server endpoint.
    • OKE Worker Node Subnet (Private): tech-news-oke-worker-subnet (10.0.2.0/24) - For worker nodes.
    • Load Balancer Subnet (Public): tech-news-lb-public-subnet (10.0.3.0/24) - For public load balancers provisioned by OKE/Istio.
  • Compartment: tech_news_prod_compartment (OCID: ocid1.compartment.oc1..aaaaaaaanexamplecompartmentocid)

Step-by-step Implementation

1. Prepare OCI Networking

First, we establish the network infrastructure within OCI. We'll create a VCN, subnets, gateways, and security lists.

Create VCN

COMPARTMENT_ID="ocid1.compartment.oc1..aaaaaaaanexamplecompartmentocid"
VCN_NAME="tech-news-prod-vcn"
VCN_CIDR="10.0.0.0/16"

VCN_OCID=$(oci network vcn create \
    --compartment-id $COMPARTMENT_ID \
    --display-name $VCN_NAME \
    --cidr-block $VCN_CIDR \
    --query 'data.id' --raw-output)

echo "Created VCN: $VCN_NAME with OCID: $VCN_OCID"
Create Subnets

# OKE API Endpoint Subnet (Private)
OKE_API_SUBNET_NAME="tech-news-oke-api-subnet"
OKE_API_SUBNET_CIDR="10.0.1.0/24"
OKE_API_SUBNET_OCID=$(oci network subnet create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name $OKE_API_SUBNET_NAME \
    --cidr-block $OKE_API_SUBNET_CIDR \
    --prohibit-public-ip-on-vnic true \
    --query 'data.id' --raw-output)
echo "Created OKE API Subnet: $OKE_API_SUBNET_NAME with OCID: $OKE_API_SUBNET_OCID"

# OKE Worker Node Subnet (Private)
OKE_WORKER_SUBNET_NAME="tech-news-oke-worker-subnet"
OKE_WORKER_SUBNET_CIDR="10.0.2.0/24"
OKE_WORKER_SUBNET_OCID=$(oci network subnet create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name $OKE_WORKER_SUBNET_NAME \
    --cidr-block $OKE_WORKER_SUBNET_CIDR \
    --prohibit-public-ip-on-vnic true \
    --query 'data.id' --raw-output)
echo "Created OKE Worker Subnet: $OKE_WORKER_SUBNET_NAME with OCID: $OKE_WORKER_SUBNET_OCID"

# Load Balancer Subnet (Public)
LB_PUBLIC_SUBNET_NAME="tech-news-lb-public-subnet"
LB_PUBLIC_SUBNET_CIDR="10.0.3.0/24"
LB_PUBLIC_SUBNET_OCID=$(oci network subnet create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name $LB_PUBLIC_SUBNET_NAME \
    --cidr-block $LB_PUBLIC_SUBNET_CIDR \
    --query 'data.id' --raw-output)
echo "Created LB Public Subnet: $LB_PUBLIC_SUBNET_NAME with OCID: $LB_PUBLIC_SUBNET_OCID"
Create Gateways and Route Tables

# Internet Gateway (for public LB access)
IG_OCID=$(oci network internet-gateway create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name "tech-news-ig" \
    --is-enabled true \
    --query 'data.id' --raw-output)
echo "Created Internet Gateway: $IG_OCID"

# NAT Gateway (for private subnet internet access, e.g., pulling images)
NAT_GW_OCID=$(oci network nat-gateway create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name "tech-news-nat-gw" \
    --query 'data.id' --raw-output)
echo "Created NAT Gateway: $NAT_GW_OCID"

# Service Gateway (for OCI services like object storage, without internet)
SVC_GW_OCID=$(oci network service-gateway create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --service-id "ocid1.service.oc1..aaaaaaaaexampleobjectstorageserviceocid" \
    --display-name "tech-news-svc-gw" \
    --query 'data.id' --raw-output) # Replace with actual Object Storage Service OCID for your region
echo "Created Service Gateway: $SVC_GW_OCID"

# Default Route Table for LB Public Subnet (to Internet Gateway)
DEFAULT_RT_ID=$(oci network vcn get --vcn-id $VCN_OCID --query 'data."default-route-table-id"' --raw-output)
oci network route-table update \
    --rt-id $DEFAULT_RT_ID \
    --route-rules "[{\"cidrBlock\":\"0.0.0.0/0\",\"networkEntityId\":\"$IG_OCID\"}]"
echo "Updated Default Route Table for LB Public Subnet."

# Route Table for Private Subnets (to NAT Gateway and Service Gateway)
PRIVATE_RT_NAME="tech-news-private-rt"
PRIVATE_RT_OCID=$(oci network route-table create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name $PRIVATE_RT_NAME \
    --route-rules "[{\"cidrBlock\":\"0.0.0.0/0\",\"networkEntityId\":\"$NAT_GW_OCID\"},{\"cidrBlock\":\"all-phx-services-in-oracle-services-network\",\"networkEntityId\":\"$SVC_GW_OCID\"}]" \
    --query 'data.id' --raw-output)
echo "Created Private Route Table: $PRIVATE_RT_OCID"

# Associate Private Route Table with Private Subnets
oci network subnet update --subnet-id $OKE_API_SUBNET_OCID --route-table-id $PRIVATE_RT_OCID
oci network subnet update --subnet-id $OKE_WORKER_SUBNET_OCID --route-table-id $PRIVATE_RT_OCID
echo "Associated Private Route Table with OKE API and Worker Subnets."
Configure Security Lists

We need to create and update security lists to allow necessary traffic for OKE and the load balancer.


# Default Security List (for OKE API and Worker Subnets)
DEFAULT_SL_ID=$(oci network vcn get --vcn-id $VCN_OCID --query 'data."default-security-list-id"' --raw-output)
echo "Default Security List OCID: $DEFAULT_SL_ID"

# Ingress for OKE API (from worker nodes and your admin machine)
# Assuming your admin machine IP is 203.0.113.10
oci network security-list update \
    --security-list-id $DEFAULT_SL_ID \
    --ingress-security-rules "[ \
        {\"protocol\": \"6\", \"source\": \"10.0.2.0/24\", \"sourceType\": \"CIDR_BLOCK\", \"tcpOptions\": {\"destinationPortRange\": {\"max\": 6443, \"min\": 6443}}}, \
        {\"protocol\": \"6\", \"source\": \"203.0.113.10/32\", \"sourceType\": \"CIDR_BLOCK\", \"tcpOptions\": {\"destinationPortRange\": {\"max\": 6443, \"min\": 6443}}}, \
        {\"protocol\": \"6\", \"source\": \"10.0.0.0/16\", \"sourceType\": \"CIDR_BLOCK\", \"tcpOptions\": {\"destinationPortRange\": {\"max\": 10250, \"min\": 10250}}} \
    ]" \
    --force
echo "Updated Default Security List for OKE API and Worker Node communication."

# Security List for Public Load Balancer Subnet (allow HTTP/HTTPS ingress)
LB_PUBLIC_SL_NAME="tech-news-lb-public-sl"
LB_PUBLIC_SL_OCID=$(oci network security-list create \
    --compartment-id $COMPARTMENT_ID \
    --vcn-id $VCN_OCID \
    --display-name $LB_PUBLIC_SL_NAME \
    --ingress-security-rules "[ \
        {\"protocol\": \"6\", \"source\": \"0.0.0.0/0\", \"sourceType\": \"CIDR_BLOCK\", \"tcpOptions\": {\"destinationPortRange\": {\"max\": 80, \"min\": 80}}}, \
        {\"protocol\": \"6\", \"source\": \"0.0.0.0/0\", \"sourceType\": \"CIDR_BLOCK\", \"tcpOptions\": {\"destinationPortRange\": {\"max\": 443, \"min\": 443}}} \
    ]" \
    --egress-security-rules "[ \
        {\"protocol\": \"all\", \"destination\": \"0.0.0.0/0\", \"destinationType\": \"CIDR_BLOCK\"} \
    ]" \
    --query 'data.id' --raw-output)
echo "Created LB Public Security List: $LB_PUBLIC_SL_OCID"

oci network subnet update --subnet-id $LB_PUBLIC_SUBNET_OCID --security-list-ids "[\"$LB_PUBLIC_SL_OCID\"]"
echo "Associated LB Public Security List with LB Public Subnet."

2. Create OCI Kubernetes Engine (OKE) Cluster

Now, we'll create the OKE cluster, specifying private endpoint access for enhanced security.


CLUSTER_NAME="tech-news-prod-oke"
K8S_VERSION="v1.27.2" # Always use a recent, stable version

CLUSTER_OCID=$(oci ce cluster create \
    --compartment-id $COMPARTMENT_ID \
    --name $CLUSTER_NAME \
    --kubernetes-version $K8S_VERSION \
    --vcn-id $VCN_OCID \
    --endpoint-config "{\"isPublicIpEnabled\": false, \"subnetId\": \"$OKE_API_SUBNET_OCID\"}" \
    --options "{\"serviceLbSubnetIds\": [\"$LB_PUBLIC_SUBNET_OCID\"], \"kubernetesNetworkConfig\": {\"podsCidr\":\"10.244.0.0/16\",\"servicesCidr\":\"10.96.0.0/16\"}}" \
    --query 'data.id' --raw-output)
echo "Creating OKE Cluster: $CLUSTER_NAME with OCID: $CLUSTER_OCID. This may take a few minutes..."

# Wait for the cluster to be in ACTIVE state
oci ce cluster get --cluster-id $CLUSTER_OCID --query 'data.lifecycle-state' --raw-output
echo "Waiting for OKE cluster to become ACTIVE..."
oci ce cluster get --cluster-id $CLUSTER_OCID --query 'data."lifecycle-state"' --raw-output --wait-for-state ACTIVE

echo "OKE Cluster is ACTIVE."

# Create Node Pool
NODE_POOL_NAME="tech-news-prod-nodepool"
NODE_SHAPE="VM.Standard.E4.Flex"
NODE_IMAGE="ocid1.image.oc1.phx.aaaaaaaaexampleokeimageocid" # Use a recent OKE-specific image OCID for your region
NODE_COUNT=3 # Start with 3 worker nodes for high availability

NODE_POOL_OCID=$(oci ce node-pool create \
    --compartment-id $COMPARTMENT_ID \
    --cluster-id $CLUSTER_OCID \
    --name $NODE_POOL_NAME \
    --kubernetes-version $K8S_VERSION \
    --node-shape $NODE_SHAPE \
    --subnet-ids "[\"$OKE_WORKER_SUBNET_OCID\"]" \
    --node-config-details "{\"size\": $NODE_COUNT, \"placementConfigs\": [{\"availabilityDomain\": \"PHX-AD-1\", \"subnetId\": \"$OKE_WORKER_SUBNET_OCID\"}]}" \
    --node-source-details "{\"sourceType\": \"IMAGE\", \"imageId\": \"$NODE_IMAGE\", \"bootVolumeSizeInGBs\": 100}" \
    --query 'data.id' --raw-output)
echo "Creating Node Pool: $NODE_POOL_NAME with OCID: $NODE_POOL_OCID. This may take a few minutes..."

# Wait for the node pool to be in ACTIVE state
oci ce node-pool get --node-pool-id $NODE_POOL_OCID --query 'data.lifecycle-state' --raw-output
echo "Waiting for Node Pool to become ACTIVE..."
oci ce node-pool get --node-pool-id $NODE_POOL_OCID --query 'data."lifecycle-state"' --raw-output --wait-for-state ACTIVE

echo "Node Pool is ACTIVE."

# Get Kubeconfig for the cluster
mkdir -p ~/.kube
oci ce cluster create-kubeconfig \
    --cluster-id $CLUSTER_OCID \
    --file ~/.kube/config \
    --region phx \
    --token-version 2.0.0 \
    --kube-endpoint PRIVATE_ENDPOINT \
    --overwrite
chmod 600 ~/.kube/config
export KUBECONFIG=~/.kube/config

echo "Kubeconfig generated. You can now interact with your OKE cluster using kubectl."
kubectl get nodes

3. Install Istio Service Mesh

Now that our OKE cluster is ready, we'll install Istio. We'll use istioctl for a streamlined installation.

Download Istio

ISTIO_VERSION="1.19.1" # Use a recent, stable Istio version
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=$ISTIO_VERSION sh -
cd istio-$ISTIO_VERSION
export PATH=$PWD/bin:$PATH
echo "Istio $ISTIO_VERSION downloaded and added to PATH."
Install Istio with a Production Profile

For production, we typically use the default or demo profile as a base and then customize it. We'll use the default profile and enable mTLS explicitly.


# Install Istio base components
istioctl install --set profile=default -y

# Verify Istio control plane components
kubectl get pods -n istio-system

The output should show istiod and other Istio components running.

Customize Istio Configuration (Optional, but recommended for production)

For more control, you can define an IstioOperator manifest. This allows you to specify resource limits, enable/disable components, and configure settings like mTLS mode.


# Save this to istio-operator-prod.yaml
cat < istio-operator-prod.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-prod-config
spec:
  profile: default
  meshConfig:
    accessLogFile: "/dev/stdout"
    defaultConfig:
      proxyMetadata:
        ISTIO_META_DNS_CAPTURE: "true"
        ISTIO_META_DNS_AUTO_ALLOCATE: "true"
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          service:
            type: LoadBalancer # OCI will provision a public Load Balancer
            annotations:
              service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
              service.beta.kubernetes.io/oci-load-balancer-shape-details-min: "10" # Min bandwidth in Mbps
              service.beta.kubernetes.io/oci-load-balancer-shape-details-max: "100" # Max bandwidth in Mbps
              service.beta.kubernetes.io/oci-load-balancer-security-list-management-mode: "All" # Let OCI manage security list rules
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
    pilot:
      k8s:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
  values:
    global:
      mtls:
        enabled: true # Enforce mTLS by default
      proxy:
        resources:
          requests:

Share this article

📧

Enjoyed this article?

Get articles like this delivered to your inbox daily. Join 10,000+ tech professionals.

Written By

Sujay Singh

Technology Expert / Cloud Architect at Virtual Venture covering AI, cloud computing, cybersecurity, and emerging tech trends.

Sources & References

• Official company announcements and press releases

• Industry reports from Gartner, IDC, and Statista

• Peer-reviewed research and technical documentation

• On-record statements from industry experts

Last verified: August 4, 2026

Fact-checked by TechNews Venture editorial team

Leave a Comment

Comments are moderated and will appear after review.