Separate command-lines from outputs.

This commit is contained in:
Martin Taillefer 2017-05-10 12:40:09 -07:00
parent 919cb69ec4
commit 5321b0cf26
5 changed files with 27 additions and 21 deletions

View File

@ -125,10 +125,13 @@ This application is polyglot, i.e., the microservices are written in different l
```bash
kubectl get ingress -o wide
```
```bash
NAME HOSTS ADDRESS PORTS AGE
gateway * 130.211.10.121 80 1d
```
```bash
export GATEWAY_URL=130.211.10.121:80
```
@ -140,17 +143,21 @@ This application is polyglot, i.e., the microservices are written in different l
You can use any of these addresses to access the ingress, but if the cluster has a firewall, you will also need to create a firewall rule
to allow TCP traffic to the NodePort. For instance, in GKE, create a firewall rule with these commands:
```bash
kubectl get svc istio-ingress -o jsonpath={.spec.ports[0].nodePort}
31201
gcloud compute firewall-rules create allow-book --allow tcp:31201
kubectl get svc istio-ingress -o jsonpath={.spec.ports[0].nodePort}
```
```bash
31201
```
```bash
gcloud compute firewall-rules create allow-book --allow tcp:31201
```
1. Confirm that the BookInfo application is running by opening in your browser http://$GATEWAY_URL/productpage , or with the following `curl` command:
```bash
curl -o /dev/null -s -w "%{http_code}\n" http://$GATEWAY_URL/productpage
```
```bash
200
```
@ -161,6 +168,8 @@ This application is polyglot, i.e., the microservices are written in different l
Get the external IP Address (and port) of the servicegraph service:
```bash
kubectl get svc servicegraph
```
```bash
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
servicegraph 10.75.240.195 104.196.248.114 8088:32556/TCP 23m
```

View File

@ -88,9 +88,6 @@ HTTP or port `443` for HTTPS.
```bash
curl http://httpbin/headers
```
```bash
.. response ..
```
3. For external services of type HTTPS, the port must be specified in the request.
App clients should make the request over HTTP since the Egress Envoy will initiate HTTPS
@ -99,9 +96,6 @@ HTTP or port `443` for HTTPS.
```bash
curl http://securegoogle:443
```
```bash
.. response ..
```
## Calling external services directly
@ -148,9 +142,6 @@ destination.
export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
kubectl exec -it $SOURCE_POD -c sleep curl http://httpbin.org/headers
```
```bash
.. response ..
```
## Understanding what happened

View File

@ -77,10 +77,6 @@ to configure ingress behavior.
curl http://$INGRESS_URL/headers
```
```
.. response ..
```
## Configuring secure ingress (HTTPS)
1. Generate keys if necessary

View File

@ -133,7 +133,7 @@ Inbound request on server pod's proxy.
```bash
kubectl logs ${SERVER} proxy | grep a641eff7-eb82-4a4f-b67b-53cd3a03c399
```
```
```bash
[2017-05-01T22:08:39.310Z] "GET / HTTP/1.1" 200 - 0 398 2 0 "-" "curl/7.47.0" "a641eff7-eb82-4a4f-b67b-53cd3a03c399" "service-two" "127.0.0.1:8080"
```

View File

@ -142,6 +142,8 @@ Verify AuthPolicy setting in ConfigMap:
```bash
kubectl get configmap istio -o yaml | grep authPolicy
```
```bash
# Istio Auth is enabled if the line "authPolicy: MUTUAL_TLS" is uncommented.
```
@ -149,6 +151,8 @@ Check the certificate and key files are mounted onto the application pod *app-po
```bash
kubectl exec <app-pod> -c proxy -- ls /etc/certs
```
```bash
# Expected files: cert-chain.pem, key.pem and root-cert.pem.
```
@ -157,8 +161,14 @@ The following commands verifies the proxy config on *app-pod* has *ssl_context*
```bash
kubectl exec <app-pod> -c proxy -- ls /etc/envoy
```
```bash
# Get the config file named "envoy-revX.json".
```
```bash
kubectl exec <app-pod> -c proxy -- cat /etc/envoy/envoy-revX.json | grep ssl_context
```
```bash
# Expect ssl_context in the output.
```