diff --git a/content/en/docs/tasks/security/authentication/mtls-migration/index.md b/content/en/docs/tasks/security/authentication/mtls-migration/index.md index 7ec31eea62..891ebeac6e 100644 --- a/content/en/docs/tasks/security/authentication/mtls-migration/index.md +++ b/content/en/docs/tasks/security/authentication/mtls-migration/index.md @@ -5,6 +5,7 @@ weight: 40 keywords: [security,authentication,migration] aliases: - /docs/tasks/security/mtls-migration/ +test: true --- This task shows how to ensure your workloads only communicate using mutual TLS as they are migrated to @@ -55,7 +56,7 @@ the policies to enforce STRICT mutual TLS between the workloads. * Verify setup by sending an http request (using curl command) from any sleep pod (among those in namespace `foo`, `bar` or `legacy`) to `httpbin.foo`. All requests should success with HTTP code 200. {{< text bash >}} - $ for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done + $ for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec "$(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name})" -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done sleep.foo to httpbin.foo: 200 sleep.foo to httpbin.bar: 200 sleep.bar to httpbin.foo: 200 @@ -96,7 +97,7 @@ EOF Now, you should see the request from `sleep.legacy` to `httpbin.foo` failing. {{< text bash >}} -$ for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done +$ for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec "$(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name})" -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done sleep.foo to httpbin.foo: 200 sleep.foo to httpbin.bar: 200 sleep.bar to httpbin.foo: 200 @@ -110,7 +111,7 @@ If you installed Istio with `values.global.proxy.privileged=true`, you can use ` traffic is encrypted or not. {{< text bash >}} -$ kubectl exec -nfoo $(kubectl get pod -nfoo -lapp=httpbin -ojsonpath={.items..metadata.name}) -c istio-proxy -it -- sudo tcpdump dst port 80 -A +$ kubectl exec -nfoo "$(kubectl get pod -nfoo -lapp=httpbin -ojsonpath={.items..metadata.name})" -c istio-proxy -it -- sudo tcpdump dst port 80 -A tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes {{< /text >}} @@ -140,7 +141,7 @@ Now, both the `foo` and `bar` namespaces enforce mutual TLS only traffic, so you failing for both. {{< text bash >}} -$ for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done +$ for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec "$(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name})" -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done {{< /text >}} ## Clean up the example diff --git a/content/en/docs/tasks/security/authentication/mtls-migration/snips.sh b/content/en/docs/tasks/security/authentication/mtls-migration/snips.sh new file mode 100644 index 0000000000..0507caa843 --- /dev/null +++ b/content/en/docs/tasks/security/authentication/mtls-migration/snips.sh @@ -0,0 +1,132 @@ +#!/bin/bash + +# Copyright Istio Authors. All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#################################################################################################### +# WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL MARKDOWN FILE: +# docs/tasks/security/authentication/mtls-migration/index.md +#################################################################################################### + +snip_set_up_the_cluster_1() { +kubectl create ns foo +kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n foo +kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml) -n foo +kubectl create ns bar +kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n bar +kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml) -n bar +} + +snip_set_up_the_cluster_2() { +kubectl create ns legacy +kubectl apply -f samples/sleep/sleep.yaml -n legacy +} + +snip_set_up_the_cluster_3() { +for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec "$(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name})" -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done +} + +# shellcheck disable=SC2034 +! read -r -d '' snip_set_up_the_cluster_3_out <}} + {{< text syntax=bash snip_id=config_all_v1 >}} $ kubectl apply -f @samples/bookinfo/networking/virtual-service-all-v1.yaml@ {{< /text >}} @@ -49,7 +50,7 @@ the [Bookinfo](/docs/examples/bookinfo/#determine-the-ingress-ip-and-port) doc. 1. Transfer 50% of the traffic from `reviews:v1` to `reviews:v3` with the following command: - {{< text bash >}} + {{< text syntax=bash snip_id=config_50_v3 >}} $ kubectl apply -f @samples/bookinfo/networking/virtual-service-reviews-50-v3.yaml@ {{< /text >}} @@ -57,7 +58,7 @@ the [Bookinfo](/docs/examples/bookinfo/#determine-the-ingress-ip-and-port) doc. 1. Confirm the rule was replaced: - {{< text bash yaml >}} + {{< text syntax=bash outputis=yaml snip_id=verify_config_50_v3 >}} $ kubectl get virtualservice reviews -o yaml apiVersion: networking.istio.io/v1alpha3 kind: VirtualService @@ -92,7 +93,7 @@ the star ratings service, but the `v1` version does not. 1. Assuming you decide that the `reviews:v3` microservice is stable, you can route 100% of the traffic to `reviews:v3` by applying this virtual service: - {{< text bash >}} + {{< text syntax=bash snip_id=config_100_v3 >}} $ kubectl apply -f @samples/bookinfo/networking/virtual-service-reviews-v3.yaml@ {{< /text >}} @@ -112,7 +113,7 @@ article [Canary Deployments using Istio](/blog/2017/0.1-canary/). 1. Remove the application routing rules: - {{< text bash >}} + {{< text syntax=bash snip_id=cleanup >}} $ kubectl delete -f @samples/bookinfo/networking/virtual-service-all-v1.yaml@ {{< /text >}} diff --git a/content/en/docs/tasks/traffic-management/traffic-shifting/snips.sh b/content/en/docs/tasks/traffic-management/traffic-shifting/snips.sh new file mode 100644 index 0000000000..2f296375a9 --- /dev/null +++ b/content/en/docs/tasks/traffic-management/traffic-shifting/snips.sh @@ -0,0 +1,62 @@ +#!/bin/bash + +# Copyright Istio Authors. All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#################################################################################################### +# WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL MARKDOWN FILE: +# docs/tasks/traffic-management/traffic-shifting/index.md +#################################################################################################### + +snip_config_all_v1() { +kubectl apply -f samples/bookinfo/networking/virtual-service-all-v1.yaml +} + +snip_config_50_v3() { +kubectl apply -f samples/bookinfo/networking/virtual-service-reviews-50-v3.yaml +} + +snip_verify_config_50_v3() { +kubectl get virtualservice reviews -o yaml +} + +# shellcheck disable=SC2034 +! read -r -d '' snip_verify_config_50_v3_out <}}$") +snippetid = re.compile(r"snip_id=(\w+)") +githubfile = re.compile(r"^([^@]*)@([\w\.\-_/]+)@([^@]*)$") +sectionhead = re.compile(r"^##+ (.*)$") +invalidchar = re.compile(r"[^0-9a-zA-Z_]") + +if len(sys.argv) < 2: + print("usage: python snip.py mdfile [ snipdir ]") + sys.exit(1) + +markdown = sys.argv[1] + +if len(sys.argv) > 2: + snipdir = sys.argv[2] +else: + snipdir = os.path.dirname(markdown) + +snipfile = "snips.sh" if markdown.split('/')[-1] == "index.md" else markdown.split('/')[-1] + "_snips.sh" + +print("generating snips: " + os.path.join(snipdir, snipfile)) + +with open(markdown, 'rt') as mdfile: + for line in mdfile: + linenum += 1 + + match = sectionhead.match(line) + if match: + snipnum = 0 + section = invalidchar.sub('', match.group(1).replace(" ", "_")).lower() + continue + + match = startsnip.match(line) + if match: + snipnum += 1 + indent = match.group(1) + kind = match.group(3) + match = snippetid.search(line) + if match: + id = "snip_" + match.group(1) + else: + id = "snip_%s_%d" % (section, snipnum) + if kind == "bash": + script = "\n%s() {\n" % id + else: + script = "\n# shellcheck disable=SC2034\n! read -r -d '' %s <}}" in line: + if current_snip["kind"] == "bash" and not output_started: + script = "}\n" + else: + script = "ENDSNIP\n" + current_snip["script"].append(script) + current_snip = None + multiline_cmd = False + output_started = False + else: + if current_snip["kind"] == "bash": + if line.startswith("$ "): + line = line[2:] + else: + if multiline_cmd: + if line == "EOF\n": + multiline_cmd = False + elif not current_snip["script"][-1].endswith("\\\n"): + # command output + if not output_started: + current_snip["script"].append("}\n\n# shellcheck disable=SC2034\n! read -r -d '' %s_out <