k8s istio config

Sample Istio config for Etherpad

Three resources: Gateway (TLS + hostname), VirtualService (routing +

websocket-friendly timeouts), DestinationRule (sticky sessions via the

socket.io io cookie).

Assumes:

- Istio >= 1.18

- A Service named etherpad in the etherpad namespace, port 9001

- A TLS secret etherpad-tls already provisioned in the gateway namespace

- Hostname etherpad.wikimedia.org — replace as needed

IMPORTANT: sticky sessions are necessary but not sufficient for multi-replica

Etherpad. Multi-replica also needs the socket.io Redis adapter so pad state

is shared across pods. Without it, two clients on the same pad routed to

different pods will see divergent state. See ether/etherpad-lite#3680.

Recommendation: start with replicas: 1 + good failover, only go multi-replica

once Redis adapter is wired up.

---

apiVersion: networking.istio.io/v1beta1 kind: Gateway metadata: name: etherpad namespace: etherpad spec: selector: istio: ingressgateway servers: - port: number: 443 name: https protocol: HTTPS tls: mode: SIMPLE credentialName: etherpad-tls hosts: - etherpad.wikimedia.org - port: number: 80 name: http protocol: HTTP hosts: - etherpad.wikimedia.org tls: httpsRedirect: true

---

apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: etherpad namespace: etherpad spec: hosts: - etherpad.wikimedia.org gateways: - etherpad http: - match: - uri: prefix: / route: - destination: host: etherpad port: number: 9001 # No per-request timeout — websockets and long-polling sit on the # connection indefinitely. Default is 15s, which kills WS upgrades. timeout: 0s

---

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: etherpad namespace: etherpad spec: host: etherpad trafficPolicy: loadBalancer: # Sticky sessions on the socket.io session cookie. Required so # long-polling fallback requests land on the same pod that owns the # session state. Pure-websocket clients don't need this, but you can't # rely on every client being able to upgrade. consistentHash: httpCookie: name: io ttl: 0s # session cookie, expires with the browser tab connectionPool: tcp: maxConnections: 10000 http: # Must exceed socket.io's pingInterval (25s) + pingTimeout (20s) by # a comfortable margin. 1h is conservative. idleTimeout: 3600s h2UpgradePolicy: UPGRADE http1MaxPendingRequests: 1000