Compare commits
4 Commits
439d62b718
...
8c1288f8d1
| Author | SHA1 | Date | |
|---|---|---|---|
|
8c1288f8d1 | ||
|
|
23eb763524 | ||
|
|
87aab0c9be | ||
|
|
6ff0ce9ee8 |
@ -5,7 +5,8 @@ include_toc: true
|
||||
|
||||
# Getting Started
|
||||
|
||||
The idea of these examples is to get yourself familiarized with the basic elements used on Istio, allowing you to explore the documentation as well of proceeding with other examples or tests on your onw.
|
||||
The idea of these examples is to get yourself familiarized with the basic elements used on Istio, allowing you to
|
||||
explore the documentation as well of proceeding with other examples or tests on your onw.
|
||||
|
||||
On these examples you will find the following Istio resources:
|
||||
|
||||
|
||||
@ -1,2 +1,12 @@
|
||||
This gloves the resources `Virtual Service` and `Destination Rule`.
|
||||
# Description
|
||||
|
||||
This section involves the configuration of `Virtual Service` objects.
|
||||
|
||||
# Examples
|
||||
|
||||
- 01-header_routing
|
||||
- 02-DirectResponse-HTTP-Body
|
||||
- 03-HTTPRewrite
|
||||
- 04-HTTPRedirect
|
||||
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ This example configures:
|
||||
|
||||
# Based on
|
||||
|
||||
- [01-hello_world_1_service_1_deployment](../../01-Getting_Started/01-hello_world_1_service_1_deployment
|
||||
- [01-hello_world_1_service_1_deployment](../../01-Getting_Started/01-hello_world_1_service_1_deployment)
|
||||
|
||||
# Configuration
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ This example configures:
|
||||
|
||||
# Based on
|
||||
|
||||
- [01-hello_world_1_service_1_deployment](../../01-Getting_Started/01-hello_world_1_service_1_deployment
|
||||
- [01-hello_world_1_service_1_deployment](../../01-Getting_Started/01-hello_world_1_service_1_deployment)
|
||||
|
||||
# Configuration
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ include_toc: true
|
||||
|
||||
# Based on
|
||||
|
||||
- [07-HTTPS-Gateway-Simple-TLS](../03-HTTPS-Gateway-Simple-TLS)
|
||||
- [03-HTTPS-Gateway-Simple-TLS](../03-HTTPS-Gateway-Simple-TLS)
|
||||
|
||||
# Description
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ include_toc: true
|
||||
|
||||
# Based on
|
||||
|
||||
- [08a-HTTPS-min-TLS-version](../04a-HTTPS-min-TLS-version)
|
||||
- [04a-HTTPS-min-TLS-version](../04a-HTTPS-min-TLS-version)
|
||||
|
||||
# Description
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ include_toc: true
|
||||
|
||||
# Based on
|
||||
|
||||
- [08a-HTTPS-min-TLS-version](../04a-HTTPS-min-TLS-version)
|
||||
- [04a-HTTPS-min-TLS-version](../04a-HTTPS-min-TLS-version)
|
||||
|
||||
# Description
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ include_toc: true
|
||||
|
||||
# Based on
|
||||
|
||||
- [10-TCP-FORWARDING](../05-TCP-FORWARDING)
|
||||
- [05-TCP-FORWARDING](../05-TCP-FORWARDING)
|
||||
|
||||
# Description
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ include_toc: true
|
||||
|
||||
# Based on
|
||||
|
||||
- [07-HTTPS-Gateway-Simple-TLS](../03-HTTPS-Gateway-Simple-TLS)
|
||||
- [03-HTTPS-Gateway-Simple-TLS](../03-HTTPS-Gateway-Simple-TLS)
|
||||
|
||||
# Description
|
||||
|
||||
|
||||
@ -0,0 +1,12 @@
|
||||
# Description
|
||||
|
||||
This section focuses (but not limited to) on the configuration of `gateway` objects, providing examples of instances regarding how to limit to which `VirtualService` objects a `Gateway` object can connect to, regarding how to configure a HTTP to HTTPS redirect, or it's TLS configuration.
|
||||
|
||||
# Examples
|
||||
|
||||
- 01-header_routing
|
||||
- 02-DirectResponse-HTTP-Body
|
||||
- 03-HTTPRewrite
|
||||
- 04-HTTPRedirect
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ include_toc: true
|
||||
|
||||
# Based on
|
||||
|
||||
- [08a-HTTPS-min-TLS-version](../../03-Gateway_Ingress/04a-HTTPS-min-TLS-version)
|
||||
- [03-Gateway_Ingress/04a-HTTPS-min-TLS-version](../../03-Gateway_Ingress/04a-HTTPS-min-TLS-version)
|
||||
|
||||
# Description
|
||||
|
||||
|
||||
@ -0,0 +1,9 @@
|
||||
# Description
|
||||
|
||||
This section will focus on the interaction with the backend and routing the traffic towards it.
|
||||
|
||||
## Examples
|
||||
|
||||
01-Service_Entry
|
||||
02-HTTPS-backend
|
||||
03-HTTPS-backend-with-mTLS (TODO)
|
||||
@ -467,7 +467,7 @@ We can see, how the `istio-proxy` container, from the `helloworld` POD, in the n
|
||||
[2023-05-15T12:48:31.605Z] "- - -" 0 UH - - "-" 0 0 0 - "-" "-" "-" "-" "-" BlackHoleCluster - 10.108.186.1:8080 172.17.247.52:53742 - -
|
||||
```
|
||||
|
||||
`BlackHoleCluster` resembles the same behavior as on the section [Curl helloworld.foo.svc.cluster.local:8080](#curl-helloworldfoosvcclusterlocal--8080).
|
||||
`BlackHoleCluster` resembles the same behavior as on the section [Curl helloworld.foo.svc.cluster.local:8080](#curl-helloworldfoosvcclusterlocal8080).
|
||||
|
||||
|
||||
|
||||
@ -527,7 +527,7 @@ We can see, how the `istio-proxy` container, from the `helloworld` POD, in the n
|
||||
[2023-05-15T12:56:49.064Z] "- - -" 0 UH - - "-" 0 0 0 - "-" "-" "-" "-" "-" BlackHoleCluster - 10.107.249.242:80 172.17.121.93:57680 - -
|
||||
```
|
||||
|
||||
`BlackHoleCluster` resembles the same behavior as on the section [Curl helloworld.foo.svc.cluster.local:8080](#curl-helloworldfoosvcclusterlocal--8080).
|
||||
`BlackHoleCluster` resembles the same behavior as on the section [Curl helloworld.foo.svc.cluster.local:8080](#curl-helloworldfoosvcclusterlocal8080).
|
||||
|
||||
|
||||
|
||||
@ -602,10 +602,7 @@ We can see, how the `istio-proxy` container, from the `helloworld` POD, in the n
|
||||
[2023-05-15T13:03:50.935Z] "- - -" 0 UH - - "-" 0 0 0 - "-" "-" "-" "-" "-" BlackHoleCluster - 10.108.186.1:80 172.17.121.93:43342 - -
|
||||
```
|
||||
|
||||
`BlackHoleCluster` resembles the same behavior as on the section [Curl helloworld.foo.svc.cluster.local:8080](#curl-helloworldfoosvcclusterlocal--8080).
|
||||
|
||||
|
||||
|
||||
`BlackHoleCluster` resembles the same behavior as on the section [Curl helloworld.foo.svc.cluster.local:8080](#curl-helloworldfoosvcclusterlocal8080).
|
||||
|
||||
|
||||
#### Curl helloworld.default.svc.cluster.local:8080
|
||||
@ -735,4 +732,6 @@ sidecar.networking.istio.io "helloworld-sidecar-foo" deleted
|
||||
|
||||
- https://istio.io/v1.0/help/ops/traffic-management/proxy-cmd/#deep-dive-into-envoy-configuration
|
||||
|
||||
- https://istio.io/latest/docs/reference/commands/pilot-discovery/#pilot-discovery-completion
|
||||
- https://istio.io/latest/docs/reference/commands/pilot-discovery/#pilot-discovery-completion
|
||||
|
||||
- https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/#change-to-the-blocking-by-default-policy
|
||||
@ -1,157 +1,33 @@
|
||||
## Description
|
||||
|
||||
On these examples, a `Sidecar` will be configured.
|
||||
|
||||
## Examples
|
||||
|
||||
- 01-ingress-proxy-forwarding
|
||||
- 02-egress-proxy
|
||||
|
||||
-
|
||||
|
||||
|
||||
|
||||
Duplicate 01, and show how it also affects traffic between services.00
|
||||
|
||||
|
||||
|
||||
|
||||
egress from (pod to pod)
|
||||
|
||||
mtls
|
||||
|
||||
|
||||
|
||||
examples showing application priority (root < namespace < workload)
|
||||
|
||||
|
||||
|
||||
|
||||
istioctl install profile=default --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY
|
||||
|
||||
## Heads up
|
||||
|
||||
On the example `02-egress-proxy`, it's a requisite to configure Istio's `meshConfig.outboundTrafficPolicy.mode` as "REGISTRY_ONLY".
|
||||
|
||||
During the installation of the cluster itself, can be set with.
|
||||
|
||||
```shell
|
||||
$ kubectl get istiooperators.install.istio.io -n istio-system
|
||||
NAME REVISION STATUS AGE
|
||||
installed-state 8d
|
||||
istioctl install profile=default --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY
|
||||
```
|
||||
|
||||
kubectl patch istiooperators installed-state -n istio-system --patch-file patch.txt
|
||||
On the current scenario, I would recommend purging the Istio installation and reinstalling again, as I assume that you
|
||||
are testing this examples in a sandbox that you are free to "destroy".
|
||||
|
||||
### Purging Istio
|
||||
|
||||
kubectl patch istiooperators installed-state -n istio-system --patch-file patch.yaml --type merge
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
---
|
||||
Set the default behavior of the sidecar for handling outbound traffic from the application. If your application uses one or more external services that are not known apriori, setting the policy to ALLOW_ANY will cause the sidecars to route any unknown traffic originating from the application to its requested destination.
|
||||
|
||||
|
||||
|
||||
---
|
||||
https://stackoverflow.com/questions/75093144/istio-sidecar-is-not-restricting-pod-connections-as-desired
|
||||
|
||||
https://github.com/istio/istio/issues/33387
|
||||
|
||||
https://gist.github.com/GregHanson/3567f5a23bcd58ad1a8acf2a4d1155eb
|
||||
|
||||
|
||||
https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/?_ga=2.259114634.1481027401.1681916557-32589553.1681916557#change-to-the-blocking-by-default-policy
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
https://docs.tetrate.io/service-bridge/1.6.x/en-us/operations ?
|
||||
|
||||
|
||||
https://istio.io/latest/docs/reference/config/networking/sidecar/
|
||||
|
||||
|
||||
https://istio.io/latest/docs/reference/glossary/#workload
|
||||
|
||||
|
||||
I am not very sure on how or why to use this...
|
||||
|
||||
|
||||
|
||||
NOT HOW TO TRIGGER / UNTRIGGER IT
|
||||
|
||||
```yaml
|
||||
apiVersion:
|
||||
networking.istio.io/v1alpha3
|
||||
kind: Sidecar
|
||||
metadata:
|
||||
name: default
|
||||
namespace: foo
|
||||
spec:
|
||||
egress:
|
||||
- hosts:
|
||||
- "./*"
|
||||
- "istio-system/*"
|
||||
```shell
|
||||
istioctl uninstall --purge
|
||||
```
|
||||
|
||||
Then proceed with reinstalling Istio using the command from above.
|
||||
|
||||
### What if I don't want to purge Istio?
|
||||
|
||||
whats this again??
|
||||
|
||||
istio operator right? ye, but what is it again? I think I checked this time ago when doing something about creating a new ingress
|
||||
|
||||
|
||||
kubectl get io -A
|
||||
|
||||
|
||||
2023-04-17T00:08:00.086475Z info validationController Not ready to switch validation to fail-closed: dummy invalid config not rejected
|
||||
|
||||
|
||||
2023-04-17T00:08:04.012630Z info validationServer configuration is invalid: gateway must have at least one server
|
||||
|
||||
|
||||
|
||||
|
||||
kubectl logs -f deployments/istiod -n istio-system
|
||||
|
||||
https://istio.io/latest/docs/reference/config/networking/sidecar/
|
||||
|
||||
|
||||
|
||||
|
||||
egress:
|
||||
- port:
|
||||
number: 8080
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- "staging/*"
|
||||
|
||||
|
||||
|
||||
With the YAML above, the sidecar proxies the traffic that’s bound for port 8080 for services running in the staging namespace.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Confirm pod ingress port forwarding
|
||||
|
||||
- Confirm it can reach other places / namespaces / resources (pod egress)
|
||||
|
||||
- mtls (somehow)
|
||||
|
||||
|
||||
# Ingress
|
||||
|
||||
Does stuff
|
||||
|
||||
# Egress
|
||||
|
||||
What is "bind"
|
||||
|
||||
# CaptureMode
|
||||
|
||||
Not my problem rn
|
||||
Modify the IstioOperator as mentioned [here](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/#change-to-the-blocking-by-default-policy).
|
||||
Loading…
x
Reference in New Issue
Block a user