Jason Skrzypek shpwrck

Steps

etcdctl endpoint status -w table

Shutdown non leader node and wait for node to report "Not Ready" and API Server to stabilize
Update Quorum Guard and wait for API Server to stabilize (control plane components should redeploy)

oc patch etcd/cluster --type=merge \

Provide a mechanism to enforce network security across clusters where membership is defined through the use of labels.

Gloo Platform Control Plane Cluster, Gloo Agent Cluster A,B
- Istio Deployment on Cluster A,B
Shared Trust (Root Trust Policy)

I used vi/websocat, but v0.10.0 because v0.11.0 didn't seem to work. Once I deployed the k8s-resources.yaml and the gloo-resources.yaml ... I:

Otherwise you can leverage piesocket. *You'll have to run the extension because "browsers don't support ws).

Content:

Notes:

*note: working document, may not apply to all installations/architectures

Manage Certificates with Cert-Manager

	#!/bin/bash

	while true; do
	cat /etc/machine-config-daemon/currentconfig \| jq -c '.metadata.annotations' \| awk --field-separator ",\|{\|}\|:\|\"" '{print $9"="$12}' > /etc/kubernetes/node-feature-discovery/features.d/node-version;
	sleep 1;
	done

	---
	apiVersion: networking.gloo.solo.io/v2
	kind: VirtualDestination
	metadata:
	name: ext-auth-service
	namespace: gloo-mesh-addons
	spec:
	ports:
	- number: 8083
	protocol: GRPC

	#!/bin/bash

	# LOAD ENV
	cat >> /root/.bashrc << EOF

	# RKE2 CONFIG
	export PATH=$PATH:/var/lib/rancher/rke2/bin
	export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
	EOF

	# Name allows overriding the release name. Generally this should not be set
	name: ""
	# revision declares which revision this gateway is a part of
	revision: "1-14-4"
	replicaCount: 1
	#kind: Deployment
	rbac:
	# If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
	# when using http://gateway-api.org/.
	enabled: true

	# Name allows overriding the release name. Generally this should not be set
	name: ""
	# revision declares which revision this gateway is a part of
	revision: "1-14-4"
	replicaCount: 1
	#kind: Deployment
	rbac:
	# If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
	# when using http://gateway-api.org/.
	enabled: true