Integrating Istio with Axway Amplify

In today’s digital landscape, APIs stand as the cornerstone of modern software architecture and connectivity. As companies expand and evolve, their digital ecosystems tend to grow increasingly complex, encompassing a multitude of APIs that serve diverse functions and connect various different applications. However, with growth comes the challenge of maintaining a clear overview of these APIs, and API management becomes crucial in this scenario. This is where the Axway Amplify platform proves its significance. With Amplify, Axway gives us the products and capabilities to govern, secure and monitor all your APIs, hosted on-premises or in the cloud, from a central location.

In this blog, we’ll provide a small introduction to Amplify and guide you through the process of integrating an Istio service mesh with this platform, enabling you to centrally govern all services in the mesh.

With Amplify, Axway aims to deliver a powerful universal API management platform that that unifies what you already have to get your digital products where they can be seen and used. Next to the API management capabilities, it also introduces a marketplace where companies can commercialize their APIs. The main asset of Amplify is however its ability to integrate with multiple other vendors like AWS, Azure or Istio. To enable this, Axway introduces the Amplify Agents, which are able to discover the underlying architecture and services on your existing systems without the need to rip and replace them. To demonstrate the functionality of the platform, we’ll go over a demo use-case in which we’ll integrate an existing Istio service mesh with Amplify. More on this service mesh can be found in our other blog.

Project scope:

First, we will go over the different components that were used in our solution and we will use a bottom up approach to describe the different layers.

So starting from the bottom, we chose for an AWS Elastic Kubernetes Service (EKS) in our demo case, but this could be any other Kubernetes cluster as Istio is platform independent. Inside this Kubernetes cluster, we integrated Istio, a service mesh designed to enhance network management, security, and observability within a microservice architecture.

Within the service mesh we used two demo microservice applications to illustrate the functionality of Istio but also the capabilities of the Axway agents to discover and propagate services to the Amplify platform.

The first application that was used is the well known “Bookinfo” application, a standard Istio demo app available from Istio’s official website. The second one was a custom application that we developed to showcase Istio specific functionalities but also to streamline the integration process with the Amplify platform.

The integration part of the solution consists of two different agents that Axway provides: a discovery agent and a traceability agent. The most important one in our case was the discovery agent as this one plays a crucial role in continuously monitoring virtual services defined within Istio and syncing them with the service registry on the Axway Amplify platform.

Now that we’ve set up our demo applications and service mesh, these can be integrated with the Axway Amplify platform. As mentioned before, Axway provides two agents (discovery and traceability). In our use case, the traceability agent wasn’t really required so only the discovery agent was installed as this one is in charge of actually discovering the services in our mesh.

To install the agent, we followed the installation guide provided by Axway on their documentation page. After installing the prerequisites, the agents can be deployed using following command:

axway central install agents

This initiates the installation procedure, which is pretty straightforward but requires some extra attention. In general, the installation guide can be followed for most steps and the default options of the prompts are fine. However, below we’ll list some of the more important choices that need to be made during the procedure.

This initiates the installation procedure, which is pretty straightforward but requires some extra attention. In general, the installation guide can be followed for most steps and the default options of the prompts are fine. However, below we’ll list some of the more important choices that need to be made during the procedure.

• Choose the correct Environment for the agents on Amplify, or create a new one if you didn’t create one yet.

• Create a new service account (DOSA) when prompted: this will create a new service account and generate a public and private key for this account.

• Use existing Istio installation: choose yes as we already set up the Istio service mesh before.

• Select the namespace of your application for the ALS Envoy Filters and the discovery of the Virtual Service resources (in our case “microshop”).

• Deploy the agents in a new namespace called ‘amplify-agents’.

After completing all steps, the procedure is complete. The Axway CLI will now create the public and private keys and the service account, but also the agent resources, the environment, and finally the agent itself and its Istio namespace. When inspecting the Amplify platform, we can confirm that the environment and the agents have been created and that they are running. However, no services will be discovered just yet. For this to happen, we need to execute some final steps.

We can see that a “istio-override.yaml” and “hybrid-override.yaml” file also have been created on our machine. Using the istio-override file and istioctl, we’ll install Istio in the demo profile with following command:

istioctl install –set profile=demo -f istio-override.yaml

After the Istio installation is complete, we can execute the final commands to finish the installation for the agents. Before doing so, however, we need to make a small adjustement to the hybrid-override file, as the axway central url in the generated file might be set incorrectly. In our case, this url should be “https://central.eu-fr.axway.com” instead of “https://apicentral.axway.com:443“.

When further inspecting the hybrid-override file, we can see another important field under da.discovery.specEndpoints. Here, the various endpoints are defined on which the Discovery agent will look for an api specification of our application. It is crucial that the location of our api specification is included in this list, otherwise the agent won’t be able to discover our services.

After setting the url correctly, the file should be ready for deployment. Now we can run the final commands to finish the installation:
helm repo add axway https://charts.axway.com/charts
helm repo update
helm upgrade –install –namespace amplify-agents ampc-hybrid axway/ampc-hybrid -f hybrid-override.yaml
After these steps, the agent should be able to discover our services, which will now show up on the Amplify Platform.

Making Istio VirtualServices Discoverable on the Axway Amplify Platform
The Amplify Platform provides us with an environment for managing and consuming APIs, and now, thanks to the discovery agent we’ve installed, we will be able to expose our (micro)services to the platform.

The Discovery Agent Essentials
This agent plays a critical role in exposing our services to the Axway Amplify Platform. It requires two critical components:
1. Virtual Services in Istio: Istio VirtualServices define routing rules for our services within the Istio service mesh. The discovery agent relies on these VirtualServices to identify the services we want to make discoverable.
Note: It is important to use the FQDN as your host in the VS, as the DA and your project live in different namespaces

2. Service Definitions: The Amplify Platform needs service definitions in a specific format, such as OpenAPI Specification (OAS), Web Services Description Language (WSDL), or Swagger JSON. These definitions should be available at a specified endpoint, which are defined in the hybrid-override.yaml

3. Automated Discovery: With VirtualServices in place and service specifications readily accessible, the discovery agent takes over. It automatically identifies and propagates these services to the Axway Amplify Platform.

And because we provided a service definition at one of the specified endpoints in the hybrid-override.yaml, we can take a look at our documentation on the Amplify platform as well.