mirror of https://github.com/istio/istio.io.git
Separate command-lines from outputs.
This commit is contained in:
parent
919cb69ec4
commit
5321b0cf26
|
|
@ -125,10 +125,13 @@ This application is polyglot, i.e., the microservices are written in different l
|
|||
|
||||
```bash
|
||||
kubectl get ingress -o wide
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
NAME HOSTS ADDRESS PORTS AGE
|
||||
gateway * 130.211.10.121 80 1d
|
||||
|
||||
```
|
||||
```bash
|
||||
export GATEWAY_URL=130.211.10.121:80
|
||||
```
|
||||
|
||||
|
|
@ -140,17 +143,21 @@ This application is polyglot, i.e., the microservices are written in different l
|
|||
You can use any of these addresses to access the ingress, but if the cluster has a firewall, you will also need to create a firewall rule
|
||||
to allow TCP traffic to the NodePort. For instance, in GKE, create a firewall rule with these commands:
|
||||
```bash
|
||||
kubectl get svc istio-ingress -o jsonpath={.spec.ports[0].nodePort}
|
||||
|
||||
31201
|
||||
|
||||
gcloud compute firewall-rules create allow-book --allow tcp:31201
|
||||
kubectl get svc istio-ingress -o jsonpath={.spec.ports[0].nodePort}
|
||||
```
|
||||
```bash
|
||||
31201
|
||||
```
|
||||
```bash
|
||||
gcloud compute firewall-rules create allow-book --allow tcp:31201
|
||||
```
|
||||
|
||||
1. Confirm that the BookInfo application is running by opening in your browser http://$GATEWAY_URL/productpage , or with the following `curl` command:
|
||||
|
||||
```bash
|
||||
curl -o /dev/null -s -w "%{http_code}\n" http://$GATEWAY_URL/productpage
|
||||
```
|
||||
```bash
|
||||
200
|
||||
```
|
||||
|
||||
|
|
@ -161,6 +168,8 @@ This application is polyglot, i.e., the microservices are written in different l
|
|||
Get the external IP Address (and port) of the servicegraph service:
|
||||
```bash
|
||||
kubectl get svc servicegraph
|
||||
```
|
||||
```bash
|
||||
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
servicegraph 10.75.240.195 104.196.248.114 8088:32556/TCP 23m
|
||||
```
|
||||
|
|
|
|||
|
|
@ -88,9 +88,6 @@ HTTP or port `443` for HTTPS.
|
|||
```bash
|
||||
curl http://httpbin/headers
|
||||
```
|
||||
```bash
|
||||
.. response ..
|
||||
```
|
||||
|
||||
3. For external services of type HTTPS, the port must be specified in the request.
|
||||
App clients should make the request over HTTP since the Egress Envoy will initiate HTTPS
|
||||
|
|
@ -99,9 +96,6 @@ HTTP or port `443` for HTTPS.
|
|||
```bash
|
||||
curl http://securegoogle:443
|
||||
```
|
||||
```bash
|
||||
.. response ..
|
||||
```
|
||||
|
||||
## Calling external services directly
|
||||
|
||||
|
|
@ -148,9 +142,6 @@ destination.
|
|||
export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
|
||||
kubectl exec -it $SOURCE_POD -c sleep curl http://httpbin.org/headers
|
||||
```
|
||||
```bash
|
||||
.. response ..
|
||||
```
|
||||
|
||||
## Understanding what happened
|
||||
|
||||
|
|
|
|||
|
|
@ -77,10 +77,6 @@ to configure ingress behavior.
|
|||
curl http://$INGRESS_URL/headers
|
||||
```
|
||||
|
||||
```
|
||||
.. response ..
|
||||
```
|
||||
|
||||
## Configuring secure ingress (HTTPS)
|
||||
|
||||
1. Generate keys if necessary
|
||||
|
|
|
|||
|
|
@ -133,7 +133,7 @@ Inbound request on server pod's proxy.
|
|||
```bash
|
||||
kubectl logs ${SERVER} proxy | grep a641eff7-eb82-4a4f-b67b-53cd3a03c399
|
||||
```
|
||||
```
|
||||
```bash
|
||||
[2017-05-01T22:08:39.310Z] "GET / HTTP/1.1" 200 - 0 398 2 0 "-" "curl/7.47.0" "a641eff7-eb82-4a4f-b67b-53cd3a03c399" "service-two" "127.0.0.1:8080"
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -142,6 +142,8 @@ Verify AuthPolicy setting in ConfigMap:
|
|||
|
||||
```bash
|
||||
kubectl get configmap istio -o yaml | grep authPolicy
|
||||
```
|
||||
```bash
|
||||
# Istio Auth is enabled if the line "authPolicy: MUTUAL_TLS" is uncommented.
|
||||
```
|
||||
|
||||
|
|
@ -149,6 +151,8 @@ Check the certificate and key files are mounted onto the application pod *app-po
|
|||
|
||||
```bash
|
||||
kubectl exec <app-pod> -c proxy -- ls /etc/certs
|
||||
```
|
||||
```bash
|
||||
# Expected files: cert-chain.pem, key.pem and root-cert.pem.
|
||||
```
|
||||
|
||||
|
|
@ -157,8 +161,14 @@ The following commands verifies the proxy config on *app-pod* has *ssl_context*
|
|||
|
||||
```bash
|
||||
kubectl exec <app-pod> -c proxy -- ls /etc/envoy
|
||||
```
|
||||
```bash
|
||||
# Get the config file named "envoy-revX.json".
|
||||
```
|
||||
```bash
|
||||
kubectl exec <app-pod> -c proxy -- cat /etc/envoy/envoy-revX.json | grep ssl_context
|
||||
```
|
||||
```bash
|
||||
# Expect ssl_context in the output.
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue