mirror of https://github.com/istio/istio.io.git
(cherry picked from commit 82939fa976)
This commit is contained in:
Martin Taillefer
GitHub
parent
3569dd74c0
commit
9c84668277
|
|
@ -0,0 +1,154 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: my-ingressgateway-service-account
|
||||
labels:
|
||||
app: my-ingressgateway
|
||||
---
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: my-ingressgateway
|
||||
labels:
|
||||
app: my-ingressgateway
|
||||
istio: my-ingressgateway
|
||||
spec:
|
||||
replicas: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: my-ingressgateway
|
||||
istio: my-ingressgateway
|
||||
annotations:
|
||||
sidecar.istio.io/inject: "false"
|
||||
scheduler.alpha.kubernetes.io/critical-pod: ""
|
||||
spec:
|
||||
serviceAccountName: my-ingressgateway-service-account
|
||||
containers:
|
||||
- name: ingressgateway
|
||||
image: "gcr.io/istio-release/proxyv2:1.0.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 443
|
||||
- containerPort: 31400
|
||||
- containerPort: 15011
|
||||
- containerPort: 8060
|
||||
- containerPort: 15030
|
||||
- containerPort: 15031
|
||||
args:
|
||||
- proxy
|
||||
- router
|
||||
- -v
|
||||
- "2"
|
||||
- --discoveryRefreshDelay
|
||||
- '1s' #discoveryRefreshDelay
|
||||
- --drainDuration
|
||||
- '45s' #drainDuration
|
||||
- --parentShutdownDuration
|
||||
- '1m0s' #parentShutdownDuration
|
||||
- --connectTimeout
|
||||
- '10s' #connectTimeout
|
||||
- --serviceCluster
|
||||
- my-ingressgateway
|
||||
- --zipkinAddress
|
||||
- zipkin.istio-system:9411
|
||||
- --statsdUdpAddress
|
||||
- istio-statsd-prom-bridge.istio-system:9125
|
||||
- --proxyAdminPort
|
||||
- "15000"
|
||||
- --controlPlaneAuthPolicy
|
||||
- NONE
|
||||
- --discoveryAddress
|
||||
- istio-pilot.istio-system:8080
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
volumeMounts:
|
||||
- mountPath: /etc/certs
|
||||
name: istio-certs
|
||||
readOnly: true
|
||||
- mountPath: /etc/istio/ingressgateway-certs
|
||||
name: ingressgateway-custom-certs
|
||||
readOnly: true
|
||||
- mountPath: /etc/istio/ingressgateway-ca-certs
|
||||
name: ingressgateway-ca-certs
|
||||
readOnly: true
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: INSTANCE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: ISTIO_META_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
volumes:
|
||||
- name: istio-certs
|
||||
secret:
|
||||
defaultMode: 420
|
||||
optional: true
|
||||
secretName: istio.istio-ingressgateway-service-account
|
||||
- name: ingressgateway-custom-certs
|
||||
secret:
|
||||
defaultMode: 420
|
||||
optional: true
|
||||
secretName: istio-customingressgateway-certs
|
||||
- name: ingressgateway-ca-certs
|
||||
secret:
|
||||
defaultMode: 420
|
||||
optional: true
|
||||
secretName: istio-ingressgateway-ca-certs
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: beta.kubernetes.io/arch
|
||||
operator: In
|
||||
values:
|
||||
- amd64
|
||||
- ppc64le
|
||||
- s390x
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 2
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: beta.kubernetes.io/arch
|
||||
operator: In
|
||||
values:
|
||||
- amd64
|
||||
- weight: 2
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: beta.kubernetes.io/arch
|
||||
operator: In
|
||||
values:
|
||||
- ppc64le
|
||||
- weight: 2
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: beta.kubernetes.io/arch
|
||||
operator: In
|
||||
values:
|
||||
- s390x
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- my-ingressgateway
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
|
@ -0,0 +1,228 @@
|
|||
---
|
||||
title: Deploy a custom ingress gateway using cert-manager
|
||||
description: Describes how to deploy a custom ingress gateway using cert-manager manually.
|
||||
subtitle: Custom ingress gateway
|
||||
publishdate: 2019-01-10
|
||||
weight: 89
|
||||
keywords: [ingress,traffic-management]
|
||||
attribution: Julien Senon
|
||||
---
|
||||
|
||||
This post provides instructions to manually create a custom ingress [gateway](/docs/reference/config/istio.networking.v1alpha3/#Gateway) with automatic provisioning of certificates based on cert-manager.
|
||||
|
||||
The creation of custom ingress gateway could be used in order to have different `loadbalancer` in order to isolate traffic.
|
||||
|
||||
## Before you begin
|
||||
|
||||
* Setup Istio by following the instructions in the
|
||||
[Installation guide](/docs/setup/).
|
||||
* Setup `cert-manager` with helm [chart](https://github.com/helm/charts/tree/master/stable/cert-manager#installing-the-chart)
|
||||
* We will use `demo.mydemo.com` for our example,
|
||||
it must be resolved with your DNS
|
||||
|
||||
## Configuring the custom ingress gateway
|
||||
|
||||
1. Check if [cert-manager](https://github.com/helm/charts/tree/master/stable/cert-manager) was installed using Helm with the following command:
|
||||
|
||||
{{< text bash >}}
|
||||
$ helm ls
|
||||
{{< /text >}}
|
||||
|
||||
The output should be similar to the example below and show cert-manager with a `STATUS` of `DEPLOYED`:
|
||||
|
||||
{{< text plain >}}
|
||||
NAME REVISION UPDATED STATUS CHART APP VERSION NAMESPACE
|
||||
istio 1 Thu Oct 11 13:34:24 2018 DEPLOYED istio-1.0.X 1.0.X istio-system
|
||||
cert 1 Wed Oct 24 14:08:36 2018 DEPLOYED cert-manager-v0.6.0-dev.2 v0.6.0-dev.2 istio-system
|
||||
{{< /text >}}
|
||||
|
||||
1. To create the cluster's issuer, apply the following configuration:
|
||||
|
||||
{{< idea_icon >}} Change the cluster's [issuer](https://cert-manager.readthedocs.io/en/latest/reference/issuers.html#issuers) provider with your own configuration values. The example uses the values under `route53`.
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: certmanager.k8s.io/v1alpha1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-demo
|
||||
namespace: kube-system
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: <REDACTED>
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-demo
|
||||
dns01:
|
||||
# Here we define a list of DNS-01 providers that can solve DNS challenges
|
||||
providers:
|
||||
- name: your-dns
|
||||
route53:
|
||||
accessKeyID: <REDACTED>
|
||||
region: eu-central-1
|
||||
secretAccessKeySecretRef:
|
||||
name: prod-route53-credentials-secret
|
||||
key: secret-access-key
|
||||
{{< /text >}}
|
||||
|
||||
1. If you use the `route53` [provider](https://cert-manager.readthedocs.io/en/latest/reference/issuers/acme/dns01.html#amazon-route53), you must provide a secret to perform DNS ACME Validation. To create the secret, apply the following configuration file:
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: prod-route53-credentials-secret
|
||||
type: Opaque
|
||||
data:
|
||||
secret-access-key: <REDACTED BASE64>
|
||||
{{< /text >}}
|
||||
|
||||
1. Create your own certificate:
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: certmanager.k8s.io/v1alpha1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: demo-certificate
|
||||
namespace: istio-system
|
||||
spec:
|
||||
acme:
|
||||
config:
|
||||
- dns01:
|
||||
provider: your-dns
|
||||
domains:
|
||||
- '*.mydemo.com'
|
||||
commonName: '*.mydemo.com'
|
||||
dnsNames:
|
||||
- '*.mydemo.com'
|
||||
issuerRef:
|
||||
kind: ClusterIssuer
|
||||
name: letsencrypt-demo
|
||||
secretName: istio-customingressgateway-certs
|
||||
{{< /text >}}
|
||||
|
||||
Make a note of the value of `secretName` since a future step requires it.
|
||||
|
||||
1. To scale automatically, declare a new horizontal pod autoscaler with the following configuration:
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: autoscaling/v1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: my-ingressgateway
|
||||
namespace: istio-system
|
||||
spec:
|
||||
maxReplicas: 5
|
||||
minReplicas: 1
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1beta1
|
||||
kind: Deployment
|
||||
name: my-ingressgateway
|
||||
targetCPUUtilizationPercentage: 80
|
||||
status:
|
||||
currentCPUUtilizationPercentage: 0
|
||||
currentReplicas: 1
|
||||
desiredReplicas: 1
|
||||
{{< /text >}}
|
||||
|
||||
1. Apply your deployment with declaration provided in the [yaml definition](/blog/2019/custom-ingress-gateway/deployment-custom-ingress.yaml)
|
||||
|
||||
{{< idea_icon >}} The annotations used, for example `aws-load-balancer-type`, only apply for AWS.
|
||||
|
||||
1. Create your service:
|
||||
|
||||
{{< warning_icon >}} The `NodePort` used needs to be an available Port.
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: my-ingressgateway
|
||||
annotations:
|
||||
service.beta.kubernetes.io/aws-load-balancer-type: nlb
|
||||
labels:
|
||||
app: my-ingressgateway
|
||||
istio: my-ingressgateway
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: my-ingressgateway
|
||||
istio: my-ingressgateway
|
||||
ports:
|
||||
-
|
||||
name: http2
|
||||
nodePort: 32380
|
||||
port: 80
|
||||
targetPort: 80
|
||||
-
|
||||
name: https
|
||||
nodePort: 32390
|
||||
port: 443
|
||||
-
|
||||
name: tcp
|
||||
nodePort: 32400
|
||||
port: 31400
|
||||
{{< /text >}}
|
||||
|
||||
1. Create your Istio custom gateway configuration object:
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: Gateway
|
||||
metadata:
|
||||
annotations:
|
||||
name: istio-custom-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
istio: my-ingressgateway
|
||||
servers:
|
||||
- hosts:
|
||||
- '*.mydemo.com'
|
||||
port:
|
||||
name: http
|
||||
number: 80
|
||||
protocol: HTTP
|
||||
tls:
|
||||
httpsRedirect: true
|
||||
- hosts:
|
||||
- '*.mydemo.com'
|
||||
port:
|
||||
name: https
|
||||
number: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
privateKey: /etc/istio/ingressgateway-certs/tls.key
|
||||
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
|
||||
{{< /text >}}
|
||||
|
||||
1. Link your `istio-custom-gateway` with your `VirtualService`:
|
||||
|
||||
{{< text yaml >}}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: my-virtualservice
|
||||
spec:
|
||||
hosts:
|
||||
- "demo.mydemo.com"
|
||||
gateways:
|
||||
- istio-custom-gateway
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: my-demoapp
|
||||
{{< /text >}}
|
||||
|
||||
1. Correct certificate is returned by the server and it is successfully verified (_SSL certificate verify ok_ is printed):
|
||||
|
||||
{{< text bash >}}
|
||||
$ curl -v `https://demo.mydemo.com`
|
||||
Server certificate:
|
||||
SSL certificate verify ok.
|
||||
{{< /text >}}
|
||||
|
||||
**Congratulations!** You can now use your custom `istio-custom-gateway` [gateway](/docs/reference/config/istio.networking.v1alpha3/#Gateway) configuration object.
|
||||
Loading…
Reference in New Issue