ston1th/kube
1
0
Fork 0
Code Releases Activity

istio improvements

Browse source
This commit is contained in:
ston1th 2019-08-07 00:42:25 +02:00
commit 97addda5f4
13 changed files with 388 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
loop.sh
View file

@ -1,2 +1,2 @@
#!/bin/sh
while true; do curl $1 2>/dev/null;sleep ${2:-1}; done
while true; do curl -k -s -L $1 2>/dev/null;sleep ${2:-1}; done

37
testapp/api/api-v1-istio.yaml
View file

@ -1,3 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: testapp-api
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
@ -17,9 +23,17 @@ spec:
app: testapp-api
version: v1
spec:
serviceAccountName: testapp-api
containers:
- name: testapp-api
image: 127.0.0.1:5000/testapp/api:v1
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
imagePullPolicy: Always
ports:
- containerPort: 8080
@ -61,10 +75,15 @@ spec:
servers:
- port:
number: 80
name: http
protocol: HTTP
name: https
protocol: HTTPS
hosts:
- httpbin.org
tls:
mode: MUTUAL
serverCertificate: /etc/certs/cert-chain.pem
privateKey: /etc/certs/key.pem
caCertificates: /etc/certs/root-cert.pem
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
@ -74,11 +93,23 @@ spec:
host: istio-egressgateway.istio-system.svc.cluster.local
subsets:
- name: httpbin
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 80
tls:
mode: ISTIO_MUTUAL
sni: httpbin.org
# trafficPolicy:
# tls:
# mode: ISTIO_MUTUAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin-egress
name: httpbin
spec:
hosts:
- httpbin.org

7
testapp/api/api-v1.yaml
View file

@ -20,6 +20,13 @@ spec:
containers:
- name: testapp-api
image: 127.0.0.1:5000/testapp/api:v1
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
imagePullPolicy: Always
ports:
- containerPort: 8080

14
testapp/db/db.yaml
View file

@ -1,3 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: testapp-db
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
@ -17,9 +23,17 @@ spec:
app: testapp-db
version: v1
spec:
serviceAccountName: testapp-db
containers:
- name: testapp-db
image: 127.0.0.1:5000/testapp/db:v1
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
imagePullPolicy: Always
ports:
- containerPort: 8080

32
testapp/istio/api-role.yaml Normal file
View file

@ -0,0 +1,32 @@
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRole
metadata:
name: testapp-api
namespace: default
spec:
rules:
- services: ["testapp-api.default.svc.cluster.local"]
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
name: testapp-api
namespace: default
spec:
subjects:
- user: "cluster.local/ns/default/sa/testapp-srv"
- user: "cluster.local/ns/default/sa/testapp-db"
roleRef:
kind: ServiceRole
name: testapp-api
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: testapp-api
namespace: default
spec:
host: testapp-api.default.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL

9
testapp/istio/cluster-rbac.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: rbac.istio.io/v1alpha1
kind: ClusterRbacConfig
metadata:
name: default
spec:
mode: 'ON_WITH_INCLUSION'
inclusion:
namespaces: ["default", "redirect"]
#services: ["istio-egressgateway.istio-system.svc.cluster.local"]

32
testapp/istio/db-role.yaml Normal file
View file

@ -0,0 +1,32 @@
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRole
metadata:
name: testapp-db
namespace: default
spec:
rules:
- services: ["testapp-db.default.svc.cluster.local"]
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
name: testapp-db
namespace: default
spec:
subjects:
- user: "cluster.local/ns/default/sa/testapp-srv"
- user: "cluster.local/ns/default/sa/testapp-api"
roleRef:
kind: ServiceRole
name: testapp-db
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: testapp-db
namespace: default
spec:
host: testapp-db.default.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL

62
testapp/istio/mtls.yaml Normal file
View file

@ -0,0 +1,62 @@
apiVersion: authentication.istio.io/v1alpha1
kind: MeshPolicy
metadata:
name: default
spec:
peers:
- mtls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: default
namespace: istio-system
spec:
host: "*.local"
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: api-server
namespace: istio-system
spec:
host: "kubernetes.default.svc.cluster.local"
trafficPolicy:
tls:
mode: DISABLE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: rook
namespace: istio-system
spec:
host: "*.rook-ceph.svc.cluster.local"
trafficPolicy:
tls:
mode: DISABLE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: kiali
namespace: istio-system
spec:
host: "kiali.istio-system.svc.cluster.local"
trafficPolicy:
tls:
mode: DISABLE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: k8s-testapp-cert
namespace: istio-system
spec:
host: "k8s-testapp-cert.istio-system.svc.cluster.local"
trafficPolicy:
tls:
mode: DISABLE

31
testapp/istio/redirect-role.yaml Normal file
View file

@ -0,0 +1,31 @@
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRole
metadata:
name: redirect
namespace: redirect
spec:
rules:
- services: ["redirect.redirect.svc.cluster.local"]
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
name: redirect
namespace: redirect
spec:
subjects:
- user: "*"
roleRef:
kind: ServiceRole
name: "redirect"
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: redirect
namespace: redirect
spec:
host: redirect.redirect.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL

31
testapp/istio/srv-role.yaml Normal file
View file

@ -0,0 +1,31 @@
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRole
metadata:
name: testapp-srv
namespace: default
spec:
rules:
- services: ["testapp-srv.default.svc.cluster.local"]
---
apiVersion: rbac.istio.io/v1alpha1
kind: ServiceRoleBinding
metadata:
name: testapp-srv
namespace: default
spec:
subjects:
- user: "*"
roleRef:
kind: ServiceRole
name: testapp-srv
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: testapp-srv
namespace: default
spec:
host: testapp-srv.default.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL

74
testapp/redirect/redirect.yaml Normal file
View file

@ -0,0 +1,74 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: redirect
namespace: redirect
---
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-config
namespace: redirect
data:
nginx.conf: |
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
---
apiVersion: v1
kind: Service
metadata:
name: redirect
namespace: redirect
labels:
app: redirect
spec:
ports:
- port: 80
name: http
selector:
app: redirect
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: redirect
namespace: redirect
labels:
app: redirect
version: v1
spec:
replicas: 1
selector:
matchLabels:
app: redirect
version: v1
template:
metadata:
labels:
app: redirect
version: v1
spec:
serviceAccountName: redirect
containers:
- name: redirect
image: nginx:stable
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 128Mi
imagePullPolicy: IfNotPresent
ports:
- containerPort: 80
volumeMounts:
- mountPath: /etc/nginx/conf.d
name: config
volumes:
- name: config
configMap:
name: nginx-config

54
testapp/srv/srv-v1-istio.yaml
View file

@ -1,3 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: testapp-srv
namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
@ -17,9 +23,17 @@ spec:
app: testapp-srv
version: v1
spec:
serviceAccountName: testapp-srv
containers:
- name: testapp-srv
- name: srv
image: 127.0.0.1:5000/testapp/srv:v1
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
imagePullPolicy: Always
ports:
- containerPort: 8080
@ -28,6 +42,8 @@ apiVersion: v1
kind: Service
metadata:
name: testapp-srv
labels:
app: testapp-srv
spec:
type: ClusterIP
ports:
@ -50,6 +66,22 @@ spec:
protocol: HTTP
hosts:
- "k8s-testapp.example.com"
- port:
number: 443
name: https
protocol: HTTPS
hosts:
- "k8s-testapp.example.com"
tls:
mode: SIMPLE
serverCertificate: "sds"
privateKey: "sds"
credentialName: "k8s-testapp-cert"
minProtocolVersion: 3 #TLSv1_2
cipherSuites:
- ECDHE-RSA-CHACHA20-POLY1305
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-RSA-AES128-GCM-SHA256
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
@ -61,7 +93,25 @@ spec:
hosts:
- "k8s-testapp.example.com"
http:
- route:
- match:
- port: 80
uri:
prefix: "/.well-known/acme-challenge"
route:
- destination:
port:
number: 8089
host: k8s-testapp-cert.istio-system.svc.cluster.local
- match:
- port: 80
route:
- destination:
port:
number: 80
host: redirect.redirect.svc.cluster.local
- match:
- port: 443
route:
- destination:
port:
number: 8080

10
testapp/srv/srv-v1.yaml
View file

@ -20,6 +20,13 @@ spec:
containers:
- name: testapp-srv
image: 127.0.0.1:5000/testapp/srv:v1
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
imagePullPolicy: Always
ports:
- containerPort: 8080
@ -28,6 +35,8 @@ apiVersion: v1
kind: Service
metadata:
name: testapp-srv
labels:
app: testapp-srv
spec:
type: ClusterIP
ports:
@ -36,7 +45,6 @@ spec:
selector:
app: testapp-srv
---
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata: