rvennam

#!/bin/bash
set -x
# clean
kubectl config use-context mydemocluster
kubectl label namespace stock-trader istio-injection-
kubectl delete pods --all
kubectl delete -f ./trader-gateway.yaml
kubectl delete -f ./trader-vs.yaml
kubectl delete -f ./stock-quote-deploy.yaml
kubectl delete -f ./trader-deploy.yaml

rvennam

https://github.com/rvennam/emcee-demos

rvennam

apiVersion: v1
items:
- apiVersion: install.istio.io/v1alpha1
  kind: IstioOperator
  metadata:
    annotations:
      armada-service: addon-istio
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"install.istio.io/v1alpha1","kind":"IstioOperator","metadata":{"annotations":{"armada-service":"addon-istio","version":"1.5.0_2107"},"labels":{"addonmanager.kubernetes.io/mode":"Reconcile"},"name":"managed-istio","namespace":"ibm-operators"},"spec":{"addonComponents":{"grafana":{"enabled":true},"kiali":{"enabled":true},"prometheus":{"enabled":true},"tracing":{"enabled":true}},"components":{"egressGateways":[{"enabled":true,"k8s":{"overlays":[{"kind":"Deployment","name":"istio-egressgateway","patches":[{"path":"spec.template.spec.containers.[name:istio-proxy].lifecycle","value":{"preStop":{"exec":{"command":["sleep","25"]}}}}]}]},"name":"istio-egressgateway"}],"ingressGateways":[{"enabled":true,"k8s":{"overlays":[{"kind":"Deployment","name":"istio-ingressgateway","patches":[{"path":"spec

rvennam

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  annotations:
    armada-service: addon-istio
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"install.istio.io/v1alpha1","kind":"IstioOperator","metadata":{"annotations":{"armada-service":"addon-istio","version":"1.6.0_2547"},"labels":{"addonmanager.kubernetes.io/mode":"Reconcile"},"name":"managed-istio","namespace":"ibm-operators"},"spec":{"addonComponents":{"grafana":{"enabled":true},"kiali":{"enabled":true},"prometheus":{"enabled":true},"tracing":{"enabled":true}},"components":{"egressGateways":[{"enabled":true,"k8s":{"overlays":[{"kind":"Deployment","name":"istio-egressgateway","patches":[{"path":"spec.template.spec.containers.[name:istio-proxy].lifecycle","value":{"preStop":{"exec":{"command":["sleep","25"]}}}},{"path":"spec.template.spec.affinity","value":{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app","operator":"I

rvennam

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  annotations:
    armada-service: addon-istio
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"install.istio.io/v1alpha1","kind":"IstioOperator","metadata":{"annotations":{"armada-service":"addon-istio","version":"1.7.0_2772"},"labels":{"addonmanager.kubernetes.io/mode":"Reconcile"},"name":"managed-istio","namespace":"ibm-operators"},"spec":{"addonComponents":{"grafana":{"enabled":false},"kiali":{"enabled":false},"prometheus":{"enabled":false},"tracing":{"enabled":false}},"components":{"egressGateways":[{"enabled":true,"k8s":{"hpaSpec":{"minReplicas":2},"overlays":[{"kind":"Deployment","name":"istio-egressgateway","patches":[{"path":"spec.template.spec.containers.[name:istio-proxy].lifecycle","value":{"preStop":{"exec":{"command":["sleep","25"]}}}},{"path":"spec.template.spec.affinity","value":{"nodeAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"preference":{"matchExpressions":[{"key":"dedicated",

rvennam

# Start clean
istioctl x uninstall --purge -y
sleep 20s
kubectl delete namespace custom-gateways
sleep 30s

# Download Istio 1.8.2
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.8.2 sh -
cd istio-1.8.2

rvennam

RELAY_ROOT_CERT_NAME=relay-root
RELAY_SERVER_CERT_NAME=relay-server-tls
RELAY_SIGNING_CERT_NAME=relay-tls-signing
MGMT_CONTEXT=mgmt
REMOTE_CONTEXT=cluster1

echo "creating root cert ..."

openssl req -new -newkey rsa:4096 -x509 -sha256 \
        -days 3650 -nodes -out ${RELAY_ROOT_CERT_NAME}.crt -keyout ${RELAY_ROOT_CERT_NAME}.key \

rvennam

Install Gloo Mesh using External Certs

MGMT CLUSTER

kubectl config use-context mgmt
kubectl create namespace gloo-mesh

Create the root, server and signing secrets

rvennam

Create a CA root cert

openssl req -new -newkey rsa:4096 -x509 -sha256 \
        -days 3650 -nodes -out relay-root.crt -keyout relay-root.key \
        -subj "/CN=enterprise-networking-ca" \
        -addext "extendedKeyUsage = clientAuth, serverAuth"

Create a server cert

rvennam

istioctl proxy-config routes productpage-v1-5c4b548f6c-sfpq7 --name 9080 -o json
[
  {
    "name": "9080",
    "virtualHosts": [
      {
        "name": "reviews.default.svc.cluster.local:9080",
        "domains": [
          "reviews.default.svc.cluster.local",