mirror of https://github.com/istio/istio.io.git
Update istio-auth.yaml to istio-demo-auth.yaml (#1809)
This commit is contained in:
parent
4609f8559c
commit
721906a161
|
@ -30,8 +30,8 @@ or
|
|||
|
||||
{{< text bash >}}
|
||||
$ helm template --namespace istio-system --set global.proxy.image=proxy \
|
||||
--values install/kubernetes/helm/istio/values-istio-auth.yaml \
|
||||
install/kubernetes/helm/istio >> install/kubernetes/istio-auth.yaml
|
||||
--values install/kubernetes/helm/istio/values-istio-demo-auth.yaml \
|
||||
install/kubernetes/helm/istio >> install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
If using Kubernetes versions prior to 1.9, you should add `--set sidecarInjectorWebhook.enabled=false`.
|
||||
|
@ -45,7 +45,7 @@ $ kubectl apply -f install/kubernetes/istio.yaml
|
|||
or
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
The rolling update process will upgrade all deployments and configmaps to the new version. After this process finishes,
|
||||
|
|
|
@ -30,7 +30,7 @@ this feature is not needed if the production setup is not using the
|
|||
[quick start](/docs/setup/kubernetes/quick-start/) with global mutual TLS enabled:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
_**OR**_
|
||||
|
@ -133,7 +133,7 @@ continuously failed health checks.
|
|||
* To disable health checking on Citadel:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
$ kubectl delete svc istio-citadel -n istio-system
|
||||
{{< /text >}}
|
||||
|
||||
|
|
|
@ -155,7 +155,7 @@ No resources found.
|
|||
Then deploy the Istio control plane with mutual TLS enabled:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
Make sure everything is up and running:
|
||||
|
|
|
@ -54,7 +54,7 @@ Citadel is up if the "AVAILABLE" column is 1.
|
|||
|
||||
### Verifying service configuration
|
||||
|
||||
* Check installation mode. If mutual TLS is enabled by default (e.g `istio-auth.yaml` was used when installing Istio), you can expect to see uncommented `authPolicy: MUTUAL_TLS` in the configmap.
|
||||
* Check installation mode. If mutual TLS is enabled by default (e.g `istio-demo-auth.yaml` was used when installing Istio), you can expect to see uncommented `authPolicy: MUTUAL_TLS` in the configmap.
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl get configmap istio -o yaml -n istio-system | grep authPolicy | head -1
|
||||
|
|
|
@ -17,7 +17,7 @@ operator-specified root certificate. This task demonstrates an example to plug c
|
|||
[quick start](/docs/setup/kubernetes/quick-start/) with global mutual TLS enabled:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
_**OR**_
|
||||
|
@ -139,5 +139,5 @@ This requires you have `openssl` installed on your machine.
|
|||
* To remove the Istio components:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl delete -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl delete -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
|
|
@ -19,7 +19,7 @@ example application for this task.
|
|||
|
||||
* Setup Istio by following the instructions in the [Installation guide](/docs/setup/).
|
||||
|
||||
Either use the `istio.yaml` (or `istio-auth.yaml`) template, which includes tracing support, or
|
||||
Either use the `istio.yaml` (or `istio-demo-auth.yaml`) template, which includes tracing support, or
|
||||
use the helm chart with tracing enabled using the `--set tracing.enabled=true` option.
|
||||
|
||||
* Deploy the [Bookinfo](/docs/examples/bookinfo/) sample application.
|
||||
|
|
|
@ -19,7 +19,7 @@ application.
|
|||
## Querying Istio Metrics
|
||||
|
||||
1. Verify that the prometheus service is running in your cluster (since 0.8 the
|
||||
prometheus setup is included in istio.yaml and istio-auth.yaml by default)
|
||||
prometheus setup is included in istio.yaml and istio-demo-auth.yaml by default)
|
||||
|
||||
In Kubernetes environments, execute the following command:
|
||||
|
||||
|
|
|
@ -11,7 +11,7 @@ Citadel uses a flag `max-workload-cert-ttl` to control the maximum lifetime for
|
|||
workloads. The default value is 7 days. If `workload-cert-ttl` on Citadel or node agent is greater than
|
||||
`max-workload-cert-ttl`, Citadel will fail issuing the certificate.
|
||||
|
||||
Modify the `istio-auth.yaml` file to customize the Citadel configuration.
|
||||
Modify the `istio-demo-auth.yaml` file to customize the Citadel configuration.
|
||||
The following modification specifies that the Istio certificates for workloads running in Kubernetes
|
||||
has 1 hours lifetime. Besides that, the maximum allowed Istio certificate lifetime is 48 hours.
|
||||
|
||||
|
|
|
@ -263,7 +263,7 @@ $ kubectl apply -f install/kubernetes/istio.yaml
|
|||
* 默认情况下安装 Istio,并强制在 sidecar 之间进行双向 TLS 身份验证。仅在保证新部署的工作负载安装了 Istio sidecar 的新建的 kubernetes 集群上使用此选项。
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
或者
|
||||
|
|
|
@ -18,7 +18,7 @@ Citadel 包含了一个检测器模块,它会周期性的检查 Citadel 的状
|
|||
* 根据[快速开始](/docs/setup/kubernetes/quick-start/)的指引部署 Istio 并启用全局双向 TLS 支持。
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
||||
_**或者**_
|
||||
|
@ -113,7 +113,7 @@ livenessProbe:
|
|||
* 在 Citadel 上禁用健康检查:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl apply -f install/kubernetes/istio-demo-auth.yaml
|
||||
$ kubectl delete svc istio-citadel -n istio-system
|
||||
{{< /text >}}
|
||||
|
||||
|
|
|
@ -125,5 +125,5 @@ keywords: [security,certificates]
|
|||
* 移除 Istio 组件:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl delete -f install/kubernetes/istio-auth.yaml
|
||||
$ kubectl delete -f install/kubernetes/istio-demo-auth.yaml
|
||||
{{< /text >}}
|
||||
|
|
Loading…
Reference in New Issue