Istio is an open-source service mesh that provides a layer of abstraction to manage service-to-service communication in microservices architectures. It offers features such as traffic management, security, observability, and resilience without requiring changes to application code. By using sidecar proxies, Istio helps to simplify the operation of distributed systems while enhancing their reliability and security.

In this article, we'll walk through the steps to deploy a Neo4j cluster on Azure Kubernetes Service (AKS) with Istio Service Mesh enabled.

Step 1: Create an AKS Kubernetes Cluster in Azure

Create an AKS Kubernetes cluster in Azure

Once the cluster is created, open a Cloud Shell session and configure your environment:

export CLUSTER=K8s-cluster-test
export RESOURCE_GROUP=Mounir-K8s-cluster_group
export LOCATION="UK South"

az account set --subscription xxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxx
az aks get-credentials --resource-group ${RESOURCE_GROUP} --name ${CLUSTER} --overwrite-existing

Step 2: Create a Neo4j Namespace

kubectl create namespace neo4j

Step 3: Enable Istio

Enable Istio Service Mesh on your AKS cluster:

az aks mesh enable --resource-group ${RESOURCE_GROUP} --name ${CLUSTER}

Step 4: Enable Sidecar Injection

To enable Istio sidecar injection, retrieve the available Istio revisions:

az aks show --resource-group ${RESOURCE_GROUP} --name ${CLUSTER} --query 'serviceMeshProfile.istio.revisions'

Example output:

[
  "asm-1-22"
]

Label the neo4j namespace for Istio injection with the specific revision:

kubectl label namespace neo4j istio.io/rev=asm-1-22

Check the labels using:

kubectl get namespace neo4j --show-labels

Important: The default istio-injection=enabled label does not work. Explicit versioning matching the control plane revision (e.g., istio.io/rev=asm-1-18) is required.

If you use:

kubectl label namespace neo4j istio-injection=enabled --overwrite

Delete the label using:

kubectl label namespace neo4j istio-injection-

Step 5: Add the Neo4j Helm chart repository:

Set the Kubernetes context to a new namespace for Neo4j:

kubectl config set-context --current --namespace=neo4j

Add the Neo4j Helm chart repository:

helm repo add neo4j https://helm.neo4j.com/neo4j

Step 6: Deploy the Neo4j Cluster

Create a values file (values.yaml) to define the Neo4j cluster configuration:

neo4j:
  name: "my-cluster"
  minimumClusterSize: 3
  resources:
    cpu: "0.5"
    memory: "2Gi"
  edition: "enterprise"
  password: "my-password"
  acceptLicenseAgreement: "yes"

volumes:
  data:
    mode: "dynamic"
    dynamic:
      # * managed-csi-premium provisions premium SSD disks (recommended)
      # * managed-csi provisions standard SSD backed disks
      storageClassName: managed-csi-premium

Install the Neo4j servers using Helm:

helm install server-1 neo4j/neo4j --namespace neo4j -f values.yaml

helm install server-2 neo4j/neo4j --namespace neo4j -f values.yaml

helm install server-3 neo4j/neo4j --namespace neo4j -f values.yaml

More details about Neo4j deployment on Kubernetes can be found here:

https://neo4j.com/docs/operations-manual/current/kubernetes/quickstart-cluster/prerequisites/

 

Check that each cluster member pod has two containers: neo4j and istio-proxy created using:

kubectl get pod server-1-0 -o jsonpath="{.spec.containers[*].name}"

Output:

neo4j istio-proxy

By following these steps, you will successfully deploy a Neo4j cluster on AKS with ISTIO Service Mesh enabled.