mirror of https://github.com/istio/istio.io.git
525 lines
12 KiB
Bash
525 lines
12 KiB
Bash
#!/bin/bash
|
|
# shellcheck disable=SC2034,SC2153,SC2155,SC2164
|
|
|
|
# Copyright Istio Authors. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
####################################################################################################
|
|
# WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL MARKDOWN FILE:
|
|
# docs/tasks/observability/gateways/index.md
|
|
####################################################################################################
|
|
|
|
snip_configuring_remote_access_1() {
|
|
export INGRESS_DOMAIN="example.com"
|
|
}
|
|
|
|
snip_configuring_remote_access_2() {
|
|
export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
|
|
export INGRESS_DOMAIN=${INGRESS_HOST}.nip.io
|
|
}
|
|
|
|
snip_option_1_secure_access_https_1() {
|
|
CERT_DIR=/tmp/certs
|
|
mkdir -p ${CERT_DIR}
|
|
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj "/O=example Inc./CN=*.${INGRESS_DOMAIN}" -keyout ${CERT_DIR}/ca.key -out ${CERT_DIR}/ca.crt
|
|
openssl req -out ${CERT_DIR}/cert.csr -newkey rsa:2048 -nodes -keyout ${CERT_DIR}/tls.key -subj "/CN=*.${INGRESS_DOMAIN}/O=example organization"
|
|
openssl x509 -req -sha256 -days 365 -CA ${CERT_DIR}/ca.crt -CAkey ${CERT_DIR}/ca.key -set_serial 0 -in ${CERT_DIR}/cert.csr -out ${CERT_DIR}/tls.crt
|
|
kubectl create -n istio-system secret tls telemetry-gw-cert --key=${CERT_DIR}/tls.key --cert=${CERT_DIR}/tls.crt
|
|
}
|
|
|
|
snip_option_1_secure_access_https_2() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: grafana-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 443
|
|
name: https-grafana
|
|
protocol: HTTPS
|
|
tls:
|
|
mode: SIMPLE
|
|
credentialName: telemetry-gw-cert
|
|
hosts:
|
|
- "grafana.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: grafana-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "grafana.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- grafana-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: grafana
|
|
port:
|
|
number: 3000
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: grafana
|
|
namespace: istio-system
|
|
spec:
|
|
host: grafana
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_1_secure_access_https_2_out <<\ENDSNIP
|
|
gateway.networking.istio.io/grafana-gateway created
|
|
virtualservice.networking.istio.io/grafana-vs created
|
|
destinationrule.networking.istio.io/grafana created
|
|
ENDSNIP
|
|
|
|
snip_option_1_secure_access_https_3() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: kiali-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 443
|
|
name: https-kiali
|
|
protocol: HTTPS
|
|
tls:
|
|
mode: SIMPLE
|
|
credentialName: telemetry-gw-cert
|
|
hosts:
|
|
- "kiali.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: kiali-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "kiali.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- kiali-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: kiali
|
|
port:
|
|
number: 20001
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: kiali
|
|
namespace: istio-system
|
|
spec:
|
|
host: kiali
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_1_secure_access_https_3_out <<\ENDSNIP
|
|
gateway.networking.istio.io/kiali-gateway created
|
|
virtualservice.networking.istio.io/kiali-vs created
|
|
destinationrule.networking.istio.io/kiali created
|
|
ENDSNIP
|
|
|
|
snip_option_1_secure_access_https_4() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: prometheus-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 443
|
|
name: https-prom
|
|
protocol: HTTPS
|
|
tls:
|
|
mode: SIMPLE
|
|
credentialName: telemetry-gw-cert
|
|
hosts:
|
|
- "prometheus.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: prometheus-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "prometheus.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- prometheus-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: prometheus
|
|
port:
|
|
number: 9090
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: prometheus
|
|
namespace: istio-system
|
|
spec:
|
|
host: prometheus
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_1_secure_access_https_4_out <<\ENDSNIP
|
|
gateway.networking.istio.io/prometheus-gateway created
|
|
virtualservice.networking.istio.io/prometheus-vs created
|
|
destinationrule.networking.istio.io/prometheus created
|
|
ENDSNIP
|
|
|
|
snip_option_1_secure_access_https_5() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: tracing-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 443
|
|
name: https-tracing
|
|
protocol: HTTPS
|
|
tls:
|
|
mode: SIMPLE
|
|
credentialName: telemetry-gw-cert
|
|
hosts:
|
|
- "tracing.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: tracing-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "tracing.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- tracing-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: tracing
|
|
port:
|
|
number: 80
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: tracing
|
|
namespace: istio-system
|
|
spec:
|
|
host: tracing
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_1_secure_access_https_5_out <<\ENDSNIP
|
|
gateway.networking.istio.io/tracing-gateway created
|
|
virtualservice.networking.istio.io/tracing-vs created
|
|
destinationrule.networking.istio.io/tracing created
|
|
ENDSNIP
|
|
|
|
snip_option_2_insecure_access_http_1() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: grafana-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 80
|
|
name: http-grafana
|
|
protocol: HTTP
|
|
hosts:
|
|
- "grafana.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: grafana-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "grafana.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- grafana-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: grafana
|
|
port:
|
|
number: 3000
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: grafana
|
|
namespace: istio-system
|
|
spec:
|
|
host: grafana
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_2_insecure_access_http_1_out <<\ENDSNIP
|
|
gateway.networking.istio.io/grafana-gateway created
|
|
virtualservice.networking.istio.io/grafana-vs created
|
|
destinationrule.networking.istio.io/grafana created
|
|
ENDSNIP
|
|
|
|
snip_option_2_insecure_access_http_2() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: kiali-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 80
|
|
name: http-kiali
|
|
protocol: HTTP
|
|
hosts:
|
|
- "kiali.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: kiali-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "kiali.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- kiali-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: kiali
|
|
port:
|
|
number: 20001
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: kiali
|
|
namespace: istio-system
|
|
spec:
|
|
host: kiali
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_2_insecure_access_http_2_out <<\ENDSNIP
|
|
gateway.networking.istio.io/kiali-gateway created
|
|
virtualservice.networking.istio.io/kiali-vs created
|
|
destinationrule.networking.istio.io/kiali created
|
|
ENDSNIP
|
|
|
|
snip_option_2_insecure_access_http_3() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: prometheus-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 80
|
|
name: http-prom
|
|
protocol: HTTP
|
|
hosts:
|
|
- "prometheus.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: prometheus-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "prometheus.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- prometheus-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: prometheus
|
|
port:
|
|
number: 9090
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: prometheus
|
|
namespace: istio-system
|
|
spec:
|
|
host: prometheus
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_2_insecure_access_http_3_out <<\ENDSNIP
|
|
gateway.networking.istio.io/prometheus-gateway created
|
|
virtualservice.networking.istio.io/prometheus-vs created
|
|
destinationrule.networking.istio.io/prometheus created
|
|
ENDSNIP
|
|
|
|
snip_option_2_insecure_access_http_4() {
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: Gateway
|
|
metadata:
|
|
name: tracing-gateway
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- port:
|
|
number: 80
|
|
name: http-tracing
|
|
protocol: HTTP
|
|
hosts:
|
|
- "tracing.${INGRESS_DOMAIN}"
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: VirtualService
|
|
metadata:
|
|
name: tracing-vs
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "tracing.${INGRESS_DOMAIN}"
|
|
gateways:
|
|
- tracing-gateway
|
|
http:
|
|
- route:
|
|
- destination:
|
|
host: tracing
|
|
port:
|
|
number: 80
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: tracing
|
|
namespace: istio-system
|
|
spec:
|
|
host: tracing
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
---
|
|
EOF
|
|
}
|
|
|
|
! read -r -d '' snip_option_2_insecure_access_http_4_out <<\ENDSNIP
|
|
gateway.networking.istio.io/tracing-gateway created
|
|
virtualservice.networking.istio.io/tracing-vs created
|
|
destinationrule.networking.istio.io/tracing created
|
|
ENDSNIP
|
|
|
|
snip_cleanup_1() {
|
|
kubectl -n istio-system delete gateway grafana-gateway kiali-gateway prometheus-gateway tracing-gateway
|
|
}
|
|
|
|
! read -r -d '' snip_cleanup_1_out <<\ENDSNIP
|
|
gateway.networking.istio.io "grafana-gateway" deleted
|
|
gateway.networking.istio.io "kiali-gateway" deleted
|
|
gateway.networking.istio.io "prometheus-gateway" deleted
|
|
gateway.networking.istio.io "tracing-gateway" deleted
|
|
ENDSNIP
|
|
|
|
snip_cleanup_2() {
|
|
kubectl -n istio-system delete virtualservice grafana-vs kiali-vs prometheus-vs tracing-vs
|
|
}
|
|
|
|
! read -r -d '' snip_cleanup_2_out <<\ENDSNIP
|
|
virtualservice.networking.istio.io "grafana-vs" deleted
|
|
virtualservice.networking.istio.io "kiali-vs" deleted
|
|
virtualservice.networking.istio.io "prometheus-vs" deleted
|
|
virtualservice.networking.istio.io "tracing-vs" deleted
|
|
ENDSNIP
|
|
|
|
snip_cleanup_3() {
|
|
kubectl -n istio-system delete destinationrule grafana kiali prometheus tracing
|
|
}
|
|
|
|
! read -r -d '' snip_cleanup_3_out <<\ENDSNIP
|
|
destinationrule.networking.istio.io "grafana" deleted
|
|
destinationrule.networking.istio.io "kiali" deleted
|
|
destinationrule.networking.istio.io "prometheus" deleted
|
|
destinationrule.networking.istio.io "tracing" deleted
|
|
ENDSNIP
|