Skip to content

Commit 63b9eba

Browse files
akanshasajimonakanshasajimon
committed
Update Blog “federating-spire-on-hpe-greenlake-for-private-cloud-enterprise”
1 parent 53acf81 commit 63b9eba

File tree

1 file changed

+31
-47
lines changed

1 file changed

+31
-47
lines changed

‎content/blog/federating-spire-on-hpe-greenlake-for-private-cloud-enterprise.md

Lines changed: 31 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ date: 2023-05-15T03:37:14.807Z
44
author: Akansha Sajimon, Nishant Chaturvedi
55
authorimage: /img/Avatar1.svg
66
disable: false
7+
tags:
8+
- SPIRE
9+
- Istio
10+
- SPIRE Federation
11+
- SPIFFE
712
---
813
<!--StartFragment-->
914

@@ -38,16 +43,12 @@ Verify the installation by checking if all pods are running and containers withi
3843

3944
```shellsession
4045
Cluster1:~ # kubectl get po -n spire
46+
NAME READY STATUS RESTARTS AGE
47+
spire-agent-92q5m 3/3 Running 0 37d
48+
spire-agent-jhgwf 3/3 Running 0 37d
49+
spire-agent-sm8gt 3/3 Running 0 37d
50+
spire-server-574474c7dc-gbzl6 2/2 Running 1 (11d ago) 37d
4151

42-
NAME                             READY   STATUS    RESTARTS   AGE
43-
44-
spire-agent-92q5m               3/3     Running   0          24h
45-
46-
spire-agent-jhgwf               3/3     Running   0          24h
47-
48-
spire-agent-sm8gt 3/3     Running   0          24h
49-
50-
spire-server-574474c7dc-gbzl6   2/2     Running   0          24h
5152
```
5253

5354
```shellsession
@@ -56,7 +57,6 @@ Cluster2:~ # kubectl get po -n spire
5657
NAME                             READY   STATUS     RESTARTS       AGE
5758

5859
spire-agent-wttmd               3/3     Running   1 (24h ago)   24h
59-
6060
spire-server-574474c7dc-2bfcx   2/2     Running   0             24h
6161
```
6262

@@ -100,7 +100,7 @@ Installing Istio with the custom patch will share the spiffe-csi-driver with
100100

101101
### 2.3.1 Apply SPIFFE ID
102102

103-
The first step is to get and apply one of SPIRE controller manager’s CRD - ClusterSPIFFEID. The CRD - ClusterSPIFFEID is a cluster-wide resource used to register workloads with SPIRE. The ClusterSPIFFEID can target all workloads in the cluster or can be optionally scoped to specific pods or namespaces via label selectors.  
103+
The first step is to get and apply one of SPIRE controller manager’s [CRD (Custom Resource Definition)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) ClusterSPIFFEID. The CRD - ClusterSPIFFEID is a cluster-wide resource used to register workloads with SPIRE. The ClusterSPIFFEID can target all workloads in the cluster or can be optionally scoped to specific pods or namespaces via label selectors.  
104104

105105
Create a ClusterSPIFFEID CRD to generate registration entries in SPIRE server for all workloads with label ***spiffe.io/spire-managed-identity: true.***
106106

@@ -124,22 +124,17 @@ kubectl patch deployment istio-ingressgateway -n istio-system -p '{"spec":{"temp
124124

125125
```shellsession
126126
Cluster1:~ # kubectl get po -n istio-system
127+
NAME READY STATUS RESTARTS AGE
128+
istio-ingressgateway-5d77cdd9d-gh9w4 1/1 Running 0 37d
129+
istiod-d5bc8669c-4bdvh 1/1 Running 0 37d
127130

128-
NAME                                   READY   STATUS    RESTARTS   AGE
129-
130-
istio-ingressgateway-5d77cdd9d-gh9w4   1/1     Running   0           24h
131-
132-
istiod-d5bc8669c-4bdvh                 1/1     Running   0           24h
133131
```
134132

135133
```shellsession
136134
Cluster2:~ #  kubectl get po -n istio-system
137-
138-
NAME                                  READY   STATUS    RESTARTS   AGE
139-
140-
istio-ingressgateway-64bd5ccbbb-kqs2h 1/1     Running 0       24h
141-
142-
istiod-d5bc8669c-thbpj                 1/1     Running   0       24h
135+
NAME READY STATUS RESTARTS AGE
136+
istio-ingressgateway-64bd5ccbbb-kqs2h 1/1 Running 0 37d
137+
istiod-d5bc8669c-thbpj 1/1 Running 0 37d
143138
```
144139

145140
<!--EndFragment-->
@@ -162,28 +157,20 @@ Ours looks something like this: 
162157

163158
```shellsession
164159
Cluster1:~ # kubectl get svc -n spire
160+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
161+
spire-controller-manager-webhook-service ClusterIP 10.111.48.177 <none> 443/TCP 37d
162+
spire-server NodePort 10.106.72.102 <none> 8081:30256/TCP 37d
163+
spire-server-bundle-endpoint LoadBalancer 10.99.0.208 172.16.17.9 8443:30889/TCP 37d
165164

166-
NAME                                       TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
167-
168-
spire-controller-manager-webhook-service   ClusterIP       10.111.48.177   <none>        443/TCP          24h
169-
170-
spire-server                               NodePort     10.106.72.102   <none>        8081:30256/TCP   24h
171-
172-
spire-server-bundle-endpoint               LoadBalancer 10.99.0.208     172.16.17.9   8443:30889/TCP   24h
173165
```
174166

175167
```shellsession
176168
Cluster2:~ # kubectl get svc -n spire
169+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
170+
spire-controller-manager-webhook-service ClusterIP 10.97.108.123 <none> 443/TCP 37d
171+
spire-server NodePort 10.104.109.247 <none> 8081:30256/TCP 37d
172+
spire-server-bundle-endpoint LoadBalancer 10.104.151.184 172.16.17.3 8443:30889/TCP 37d
177173

178-
NAME                                       TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)           AGE
179-
180-
spire-controller-manager-webhook-service   ClusterIP      10.97.108.123    <none>         443/TCP         24h
181-
182-
spire-server                               NodePort       10.104.109.247   <none>         8081:32614/TCP   24h
183-
184-
spire-server-bundle-endpoint             LoadBalancer   10.104.151.184 172.16.17.3   8443:31587/TCP   24h
185-
186-
187174
```
188175

189176
## 3.2 Create cluster federated trust domain 
@@ -192,8 +179,12 @@ The Cluster Federated Trust Domain CRD is used to federate the clusters with eac
192179

193180
It requires the following configurations: 
194181

182+
Cluster Federated Trust Domain:
183+
195184
![Cluster Federated Trust Domain](/img/table1.png)
196185

186+
Bundle Endpoint:
187+
197188
![Bundle Endpoint](/img/table2.png)
198189

199190
The sample CRD’s can be applied to each cluster.
@@ -266,20 +257,13 @@ curl-greeter                      2/2     Running  
266257
```shellsession
267258
Cluster2:~ # kubectl get po
268259

269-
NAME                               READY   STATUS    RESTARTS   AGE
270-
271-
details-v1-bff8759df-vkvb4       2/2     Running   0          16h
272-
260+
NAME                               READY   STATUS    RESTARTS   AGE
261+
details-v1-bff8759df-vkvb4       2/2     Running   0          16h
273262
greeter-client-76686757cd-6j2ft   2/2     Running   0          21h
274-
275263
productpage-v1-98887b9b-x5k24     2/2     Running   0          16h
276-
277264
ratings-v1-7ddbb859fc-htmfq       2/2     Running   0          16h
278-
279265
reviews-v1-67b576c8bf-jr6tj       2/2     Running   0          16h
280-
281266
reviews-v2-7ffbdcc5f7-m2c29       2/2     Running   0          16h
282-
283267
reviews-v3-6dbfcc6d89-zn9tw       2/2     Running   0          16h
284268
```
285269

0 commit comments

Comments
 (0)