+This will install the Istio 1.18.2 minimal profile with ["Istio core" "Istiod"] components into the cluster. Proceed? (y/N) y +✔ Istio core installed +✔ Istiod installed +✔ Installation complete +Making this installation the default for injection and validation. ++ +#### Ingress + +```shell +istioctl install --kubeconfig ksetup/Exported/kubeconfig.conf -f PostInstall_Example_Config_Files/IstioOperator_Ingress.yaml +``` + +
+This will install the Istio 1.18.2 empty profile into the cluster. Proceed? (y/N) y +✔ Ingress gateways installed +✔ Installation complete ++ +#### Check status + +We can see that the Load Balancer we deployed, the `External-IP` field is set to "pending". That's expected, since we have no service providing an IP for us. + +```shell +kubectl get svc --kubeconfig ksetup/Exported/kubeconfig.conf -A +``` + +
+NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +default helloworld ClusterIP 10.107.193.163 <none> 80/TCP 8h +default kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 9h +istio-system istio-ingressgateway LoadBalancer 10.96.74.132 <pending> 15021:31543/TCP,80:31989/TCP,443:31913/TCP 64s +istio-system istiod ClusterIP 10.108.199.210 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP 79s +kube-system kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 9h +metallb-system webhook-service ClusterIP 10.100.237.6 <none> 443/TCP 7h42m ++ + + +## MetalLB + +Let's work on our way to provide an IP for the that are on "pending" status. + +### Deploy + +```shell +kubectl create --kubeconfig ksetup/Exported/kubeconfig.conf -f PostInstall_Example_Config_Files/MetalLB.yaml +``` + +```text +ipaddresspool.metallb.io/pool1-group created +l2advertisement.metallb.io/pool1-advert created +``` + +### What did we deploy? + +#### pool1-group + +States a range/group of IP addresses to use for our services. + +- `192.168.1.72/30` + +#### pool1-advert + +Advertises the desired IP ranges (in our scenario it's `pool1-group`) to the network, that way resources can reach out to such. + +### Check status + +Now ur services are allowed to have an IP within the "reserved"/configured range. + +```shell +kubectl get svc --kubeconfig ksetup/Exported/kubeconfig.conf -n istio-system istio-ingressgateway +``` + +```text +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +istio-ingressgateway LoadBalancer 10.96.74.132 192.168.1.72 15021:31543/TCP,80:31989/TCP,443:31913/TCP 9m21s +``` + +## Test ingress. + +### HealthCheck + +Healthcheck passes correctly. + +```shell +curl 192.168.1.72:15021/healthz/ready -I +``` + +```text +HTTP/1.1 200 OK +date: Sat, 29 Jul 2023 22:59:49 GMT +x-envoy-upstream-service-time: 0 +server: envoy +transfer-encoding: chunked +``` + +### Deploy mock resources + +```shell +kubectl create --kubeconfig ksetup/Exported/kubeconfig.conf -f PostInstall_Example_Config_Files/Test_Services +``` + +```text +deployment.apps/helloworld-nginx created +gateway.networking.istio.io/helloworld-gateway created +service/helloworld created +virtualservice.networking.istio.io/helloworld-vs created +``` + +### Test mock resources + +We are able to receive response from the Nginx Deployment. + +```shell +curl 192.168.1.72/helloworld +``` + +```text + + + +
If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.
+ +For online documentation and support please refer to
+nginx.org.
+Commercial support is available at
+nginx.com.
Thank you for using nginx.
+ + +``` \ No newline at end of file diff --git a/ksetup/K/testD/Deployment.yaml b/PostInstall_Example_Config_Files/Test_Services/Deployment.yaml old mode 100755 new mode 100644 similarity index 100% rename from ksetup/K/testD/Deployment.yaml rename to PostInstall_Example_Config_Files/Test_Services/Deployment.yaml diff --git a/ksetup/K/testD/Gateway.yaml b/PostInstall_Example_Config_Files/Test_Services/Gateway.yaml similarity index 89% rename from ksetup/K/testD/Gateway.yaml rename to PostInstall_Example_Config_Files/Test_Services/Gateway.yaml index 8e13616..7a88507 100644 --- a/ksetup/K/testD/Gateway.yaml +++ b/PostInstall_Example_Config_Files/Test_Services/Gateway.yaml @@ -4,7 +4,7 @@ metadata: name: helloworld-gateway spec: selector: - istio: public-ingress + istio: ingressgateway servers: - port: number: 80 diff --git a/ksetup/K/testD/Service.yaml b/PostInstall_Example_Config_Files/Test_Services/Service.yaml similarity index 100% rename from ksetup/K/testD/Service.yaml rename to PostInstall_Example_Config_Files/Test_Services/Service.yaml diff --git a/ksetup/K/testD/VirtualService.yaml b/PostInstall_Example_Config_Files/Test_Services/VirtualService.yaml old mode 100755 new mode 100644 similarity index 100% rename from ksetup/K/testD/VirtualService.yaml rename to PostInstall_Example_Config_Files/Test_Services/VirtualService.yaml diff --git a/ksetup/K/IstioOperator_PublicIngress.yaml b/ksetup/K/IstioOperator_PublicIngress.yaml deleted file mode 100644 index aa01cb0..0000000 --- a/ksetup/K/IstioOperator_PublicIngress.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: install.istio.io/v1alpha1 -kind: IstioOperator -metadata: - namespace: istio-system - name: public-ingress - labels: - last-update: 2023-07-16 -spec: - profile: empty - components: - ingressGateways: - - namespace: istio-system - name: istio-public-ingress - enabled: true - label: - istio: public-ingress - app: istio-public-ingress - k8s: - service: - type: LoadBalancer - loadBalancerIP: 192.168.1.98 -# ports: -# - port: 80 -# targetPort: 31242 -# name: http -# -# - port: 443 -# targetPort: 32271 -# name: https -# -# - port: 15021 -# targetPort: 31546 -# name: tcp \ No newline at end of file diff --git a/ksetup/K/testD/README.md b/ksetup/K/testD/README.md deleted file mode 100755 index 0641ada..0000000 --- a/ksetup/K/testD/README.md +++ /dev/null @@ -1,236 +0,0 @@ ---- -gitea: none -include_toc: true ---- - - -# Description - -This is the most basic example, most of the examples spread through this [repository](../../) will be using variants of this. - -This example configures: - - Generic Kubernetes resources: - - 1 Service - - 1 Deployment - - Istio resources: - - 1 Gateway - - 1 Virtual Service - -> **Note:**\ -> I don't intend to explain thing related to Kubernetes unless necessary. - -# Configuration - -## Service - -Creates a service named `helloworld`. - -This service listens for the port `80` expecting `HTTP` traffic and will forward the incoming traffic towards the port `80` from the destination pod. - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: helloworld - labels: - app: helloworld - service: helloworld -spec: - ports: - - port: 80 - name: http - selector: - app: helloworld -``` - -## Deployment - -Deploys a Nginx server that listens for the port `80`. - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: helloworld-nginx - labels: - app: helloworld -spec: - replicas: 1 - selector: - matchLabels: - app: helloworld - template: - metadata: - labels: - app: helloworld - spec: - containers: - - name: helloworld - image: nginx - resources: - requests: - cpu: "100m" - imagePullPolicy: IfNotPresent #Always - ports: - - containerPort: 80 -``` - -## Gateway - -Deploys an Istio gateway that's listening to the port `80` for `HTTP` traffic. - -It doesn't filter for any specific host. - -The `selector` field is used to "choose" which Istio Load Balancers will have this gateway assigned to. - -The Istio `default` profile creates a Load Balancer in the namespace `istio-system` that has the label `istio: ingressgateway` set, allowing us to target that specific Load Balancer and assign this gateway resource to it. - -```yaml -apiVersion: networking.istio.io/v1alpha3 -kind: Gateway -metadata: - name: helloworld-gateway -spec: - selector: - istio: ingressgateway - servers: - - port: - number: 80 - name: http - protocol: HTTP - hosts: - - "*" -``` - -## VirtualService - -The Virtual Service resources are used to route and filter the received traffic from the gateway resources, and route it towards the desired destination. - -On this example we select the gateway `helloworld-gateway`, which is the [gateway that 's described in the `Gateway` section](#gateway). - -On this resource, we are also not limiting the incoming traffic to any specific host, allowing for all the incoming traffic to go through the rules set. - -Here we created a rule that will be applied on `HTTP` related traffic (including `HTTPS` and `HTTP2`) when the destination path is exactly `/helloworld`. - -This traffic will be forwarded to the port `80` of the destination service `helloworld` (the full path URL equivalent would be `helloworld.$NAMESPACE.svc.cluster.local`). - -Additionally, there will be an internal URL rewrite set, as if the URL is not modified, it would attempt to reach to the `/helloworld` path from the Nginx deployment, which currently has no content and would result in an error code `404` (Not found). - -```yaml -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: helloworld-vs -spec: - hosts: - - "*" - gateways: - - helloworld-gateway - http: - - match: - - uri: - exact: /helloworld - route: - - destination: - host: helloworld - port: - number: 80 - rewrite: - uri: "/" -``` - -# Walkthrough - -## Deploy resources - -Deploy the resources. - -```shell -kubectl apply -f ./ -``` -```text -deployment.apps/helloworld-nginx created -gateway.networking.istio.io/helloworld-gateway created -service/helloworld created -virtualservice.networking.istio.io/helloworld-vs created -``` - -## Wait for the deployment to be ready - -Wait for the Nginx deployment to be up and ready. - -```shell -kubectl get deployment helloworld-nginx -w -``` -```text -NAME READY UP-TO-DATE AVAILABLE AGE -helloworld-nginx 1/1 1 1 44s -``` - -## Test the service - -### Get LB IP - -To perform the desired tests, we will need to obtain the IP Istio Load Balancer that we selected in the [Gateway section](#gateway). - -On my environment, the IP is the `192.168.1.50`. - -```shell -kubectl get svc -l istio=ingressgateway -A -``` -```text -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -istio-ingressgateway LoadBalancer 10.97.47.216 192.168.1.50 15021:31316/TCP,80:32012/TCP,443:32486/TCP 39h -``` - -### Curl /helloworld - -Due to accessing the path `/helloworld`, we are triggering the rule set on the [VirtualService configuration](#virtualservice), sending a request to the Nginx backend and returning us its contents. - -```shell -curl 192.168.1.50/helloworld -s | grep "