Expose a TSE-hosted Service to a local Lattice Service Network
Automatically add TSE services to the Lattice Service Registry
Tetrate Service Express (TSE) can automatically add TSE-hosted services to the Lattice Service Registry when services are exposed through an Ingress Gateway. These services can then be discovered and consumed by Lattice clients.
Lattice Integration is currently released as an early preview of the capability. Please provide feedback, but do not rely on this feature in a production environment.
How does the integration work?
The TSE Control Plane on each EKS Workload cluster uses an AWS Controller service to manage Lattice service entries. The AWS Controller component is shipped with TSE and supported by Tetrate. It is not installed by default, and can be added to one or more clusters by redeploying the ControlPlane component.
You connect an EKS Workload cluster to Lattice by associating its VPC with the Lattice Service Network. You then configure that EKS/TSE cluster so that when services are exposed by TSE through an Ingress Gateway, these services are registered with the Lattice Service Network:
![]() |
---|
These instructions assume you are familiar with Amazon VPC Lattice and you are familiar with TSE, specifically the process of creating an Ingress Gateway and then exposing a service using a Gateway resource.
The example in these instructions builds on the Getting Started guide to Publish a Service.
Onboard a TSE cluster
Prerequisites
Before you proceed, you should have:
- A Lattice Service Network in your selected region, containing a VPC where there is a simple virtual machine (VM). You will issue curl requests from the VM to access the service in TSE; verify that you can access the VM.
- A TSE EKS Workload cluster in the same region, which you wish to onboard to the Service Network. This cluster should use a different VPC.
Create an IAM Policy
First, create a policy with permissions to manage VPC Lattice resources.
cat <<EOF > AllowVPCLatticeCRUD.yaml
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"vpc-lattice:*",
"elasticloadbalancing:DescribeLoadBalancers",
"ec2:DescribeVpcs"
],
"Resource": ["*"]
}
]
}
EOF
POLICY_NAME=AllowVPCLatticeUpdates
aws iam create-policy --policy-name ${POLICY_NAME} --policy-document file://AllowVPCLatticeCRUD.yaml
Onboard a TSE Cluster
Follow these steps for each TSE EKS Workload cluster you wish to associate with a Lattice Service Network.
Associate with the Lattice Service Network
For each EKS workload cluster, use the AWS Console to create a new VPC association, adding the VPC for the EKS cluster.
Your service network should now contain VPC associations for both the EC2 VM's VPC and the EKS Cluster's VPC.
Create a Service Account
On each workload cluster associated with the Lattice Service Network, create a Service Account for AWS IAM to allow the AWS Controller to manage VPC Lattice resources. The Service Account uses the previously-created policy.
Check that you have correctly set
$EKS_CLUSTER_NAME
and$REGION
, and set$ACCOUNT
to your 12-digit account ID:SA_NAME=vpclattice-sa
eksctl create iamserviceaccount \
--cluster $EKS_CLUSTER_NAME \
--region $REGION \
--name ${SA_NAME} \
--namespace istio-system \
--attach-policy-arn arn:aws:iam::${ACCOUNT}:policy/${POLICY_NAME} \
--approveEnable the AWS Controller
On each workload cluster associated with the Lattice Service Network, redeploy the Control Plane to enable the AWS Controller service:
helm get values tse-cp -n istio-system > cp-values.yaml helm upgrade tse-cp tse/controlplane \ --namespace istio-system \ --version 1.8.0+tse \ -f cp-values.yaml \ --set spec.providerSettings.lattice.enabled=true \ --set spec.providerSettings.aws.serviceAccountName=${SA_NAME}
You can verify the installation and inspect the settings:
kubectl get sa -n istio-system | grep $SA_NAME
kubectl get deployments -n istio-system aws-controller
kubectl get pods -n istio-system -l app=aws-controller
kubectl get clusterrole tsb-aws-controller-cp
kubectl get clusterrolebinding tsb-aws-controller-cpFollow the logs using:
kubectl logs -f -n istio-system -l app=aws-controller
You have now configured your EKS cluster with appropriate permissions and services so that it can publish services on the Lattice Service Network.
Expose a Mesh Service
Prerequisites
Before you proceed, you should have:
- Configured your EKS cluster so it can publish services on the Lattice Service Network.
- Deployed a service, an Ingress Gateway and configured a Gateway Group in your TSE EKS workload cluster.
If you have a complex configuration, you will also need to create appropriate security groups to allow traffic between the VPCs and the Service Network. This is not necessary for the simple, default configuration.
Prepare the Service
The steps in this example use the bookinfo service.
Reference: Preparing the TSE EKS Cluster with the bookinfo application
Deploy the bookinfo application
kubectl create namespace bookinfo
kubectl label namespace bookinfo istio-injection=enabled
kubectl apply -n bookinfo -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/platform/kube/bookinfo.yaml