Configuring Istio with Mulesoft RTF via IngressClass

1. Download and Install the Istio CLI

First, fetch the latest Istio release and configure your local environment.

# Download Istio
curl -L https://istio.io/downloadIstio | sh -

# Navigate to the package directory
ISTIO_DIR=$(ls -d istio-* | head -n 1)
cd $ISTIO_DIR

# Add istioctl to your PATH
export PATH=$PWD/bin:$PATH

2. Install Istio (Default Profile)

Install the Istio control plane and the ingress gateway.

istioctl install --set profile=default -y

Verify the installation:

kubectl get pods -n istio-system
kubectl get svc -n istio-system istio-ingressgateway

3. Enable Istio Sidecar Injection

Label the namespace where your RTF applications will be deployed to ensure the Istio proxy (sidecar) is automatically injected.

kubectl label namespace <rtf-app-namespace> istio-injection=enabled --overwrite

4. Create TLS Secrets

RTF requires the TLS certificate to be present in both the rtf namespace (for synchronization) and the istio-system namespace (for the gateway to terminate traffic).

Note: Replace base64 encoded cert/key with your actual encoded strings.

apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
  namespace: rtf
  labels:
    rtf.mulesoft.com/synchronized: "true"
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-cert>
  tls.key: <base64-encoded-key>
---
apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
  namespace: istio-system
  labels:
    rtf.mulesoft.com/synchronized: "true"
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-cert>
  tls.key: <base64-encoded-key>

5. Define the IngressClass

Create an IngressClass to tell Kubernetes that Istio should handle Ingress resources specifically tagged with the istio class

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: istio
spec:
  controller: istio.io/ingress-controller

6. Apply HTTPRouteTemplates

RTF uses HTTPRouteTemplates to automatically generate Kubernetes Ingress resources when you deploy an API. If you have multiple domains (e.g., a base domain and a wildcard), you need a template for each.

Template for istio.techworld360.io

apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: rtf-hrt-istio-ingress
  namespace: rtf
spec:
  baseEndpoints:
    - https://istio.techworld360.io
  resources:
    - |
      apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        ingressClassName: istio
        tls:
        - hosts:
          - {{ .Host }}
          secretName: tls-secret
        rules:
        - host: {{ .Host }}
          http:
            paths:
            - pathType: Prefix
              path: {{ .Path }}
              backend:
                service:
                  name: {{ .Service.Name }}
                  port:
                    name: {{ .Service.PortName }}

Template for *.istio.techworld360.io

apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: rtf-hrt-istio-ingress-wildcard
  namespace: rtf
spec:
  baseEndpoints:
    - https://*.istio.techworld360.io
  resources:
    - |
      apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        ingressClassName: istio
        tls:
        - hosts:
          - {{ .Host }}
          secretName: tls-secret
        rules:
        - host: {{ .Host }}
          http:
            paths:
            - pathType: Prefix
              path: {{ .Path }}
              backend:
                service:
                  name: {{ .Service.Name }}
                  port:
                    name: {{ .Service.PortName }}

7. Configure RBAC for RTF Agent

The RTF agent needs permission to interact with Istio resources to manage the traffic flow correctly.

# istio-permissions-rtf.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: rtf-istio-gateway-manager
rules:
- apiGroups: ["networking.istio.io"]
  resources: ["gateways", "virtualservices"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
# istio-permissions-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: rtf-istio-binding
subjects:
- kind: ServiceAccount
  name: rtf-agent
  namespace: rtf
roleRef:
  kind: ClusterRole
  name: rtf-istio-gateway-manager
  apiGroup: rbac.authorization.k8s.io

8. Verification

Deploy your application from the Anypoint Runtime Manager UI. Once deployed, verify the pods and the sidecar injection.

Check the pods:

kubectl get po -n <your-app-namespace>

You should see READY 3/3 (or similar), indicating that the istio-proxy sidecar is running alongside the Mule runtime and the app-init containers.

Pro Tip: If your pods aren’t showing the extra container, double-check that the namespace label istio-injection=enabled was applied before the deployment.