shpwrck

#!/bin/bash  

while true; do
  cat /etc/machine-config-daemon/currentconfig | jq -c '.metadata.annotations' | awk --field-separator ",|{|}|:|\"" '{print $9"="$12}' > /etc/kubernetes/node-feature-discovery/features.d/node-version;
  sleep 1;
done

shpwrck

---
apiVersion: networking.gloo.solo.io/v2
kind: VirtualDestination
metadata:
  name: ext-auth-service
  namespace: gloo-mesh-addons
spec:
  ports:
  - number: 8083
    protocol: GRPC

shpwrck

Requirements

Provide a mechanism to enforce network security across clusters where membership is defined through the use of labels.

Components

Pre-Installed Components

• Gloo Platform Control Plane Cluster, Gloo Agent Cluster A,B
  • Istio Deployment on Cluster A,B
• Shared Trust (Root Trust Policy)

shpwrck

#!/bin/bash

# LOAD ENV
cat >> /root/.bashrc << EOF

# RKE2 CONFIG
export PATH=$PATH:/var/lib/rancher/rke2/bin
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
EOF

shpwrck

I used vi/websocat, but v0.10.0 because v0.11.0 didn't seem to work. Once I deployed the k8s-resources.yaml and the gloo-resources.yaml ... I:

• Ran websocat ws://<<gateway_ip>> from within the websocat container
• Passed in some values
• Cancelled
• Checked the logs for connection information.

Otherwise you can leverage piesocket. *You'll have to run the extension because "browsers don't support ws).

shpwrck

  # Name allows overriding the release name. Generally this should not be set
  name: ""
  # revision declares which revision this gateway is a part of
  revision: "1-14-4"
  replicaCount: 1
  #kind: Deployment
  rbac:
    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
    # when using http://gateway-api.org/.
    enabled: true

shpwrck

  # Name allows overriding the release name. Generally this should not be set
  name: ""
  # revision declares which revision this gateway is a part of
  revision: "1-14-4"
  replicaCount: 1
  #kind: Deployment
  rbac:
    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
    # when using http://gateway-api.org/.
    enabled: true

shpwrck

My tests and test files

Content:

• scale-test.sh
• glooResources.yaml
• appResources.yaml

Notes:

• hardcoded cluster names (mgmt,worker-1,worker-2)
• replicas set to 0 by default

shpwrck

Config required to scale and secure Istio for production

*note: working document, may not apply to all installations/architectures

Cert Management

Manage Certificates with Cert-Manager

Benefit:

shpwrck

Demonstration of Failover Priority with Istio Multicluster

Sample Environment

• Four Clusters: {alvin,simon,theodore,dave}
• Ingress Gateway
• East-West Gateway
• Istiod
• Istio Echo Application