|
1 | 1 | --- |
2 | 2 | title: "Deploy apps" |
3 | | -weight: 4 |
| 3 | +weight: 5 |
4 | 4 | description: "Duration: 5 min | Persona: Apps Operator" |
5 | 5 | tags: ["apps-operator", "asm"] |
6 | 6 | --- |
7 | 7 |  |
8 | 8 | _{{< param description >}}_ |
9 | 9 |
|
10 | | -In this section, you will deploy via Kustomize the Online Boutique apps in the dedicated namespace. |
| 10 | +In this section, you will deploy the Online Boutique apps. |
11 | 11 |
|
12 | 12 | Initialize variables: |
13 | 13 | ```Bash |
14 | 14 | WORK_DIR=~/ |
15 | 15 | source ${WORK_DIR}acm-workshop-variables.sh |
16 | 16 | ``` |
17 | 17 |
|
18 | | -## Get upstream Kubernetes manifests |
| 18 | +## Update base overlay |
19 | 19 |
|
20 | | -Get the upstream Kubernetes manifests: |
| 20 | +Update the Kustomize base overlay: |
21 | 21 | ```Bash |
22 | | -cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME |
23 | | -mkdir upstream |
24 | | -cd upstream |
25 | | -kpt pkg get https://github.com/GoogleCloudPlatform/anthos-service-mesh-samples.git/docs/online-boutique-asm-manifests/base@main |
26 | | -``` |
27 | | - |
28 | | -## Create base overlay |
29 | | - |
30 | | -Create Kustomize base overlay files: |
31 | | -```Bash |
32 | | -cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME |
33 | | -mkdir base |
34 | | -cd base |
35 | | -kustomize create --resources ../upstream/base/all |
36 | | -cat <<EOF >> kustomization.yaml |
| 22 | +cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/base |
| 23 | +kustomize edit add resource ../upstream/base |
| 24 | +cat <<EOF >> ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/base/kustomization.yaml |
37 | 25 | patchesStrategicMerge: |
38 | 26 | - |- |
39 | 27 | apiVersion: v1 |
40 | | - kind: Namespace |
| 28 | + kind: Service |
41 | 29 | metadata: |
42 | | - name: onlineboutique |
| 30 | + name: frontend-external |
43 | 31 | \$patch: delete |
44 | 32 | EOF |
45 | 33 | ``` |
46 | 34 | {{% notice info %}} |
47 | | -We are removing the upstream `Namespace` resource as we already defined it in a previous section while configuring the associated Config Sync's `RepoSync` setup. |
| 35 | +Here we are deleting the `Service` `frontend-external` because the `frontend` app will be exposed by the Ingress Gateway. |
48 | 36 | {{% /notice %}} |
49 | 37 |
|
50 | | -You could browse the files in the `${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/upstream/base` folder, along with the `Namespace`, `Deployment` and `Service` for the OnlineBoutique apps, you could see the `VirtualService` resource which will allow to establish the Ingress Gateway routing to the OnlineBoutique app. The `spec.hosts` value is `"*"` but in the following part you will replace this value by the actual DNS of the OnlineBoutique solution (i.e. `ONLINE_BOUTIQUE_INGRESS_GATEWAY_HOST_NAME`) defined in a previous section. |
| 38 | +## Define VirtualService |
51 | 39 |
|
52 | | -## Define Staging namespace overlay |
| 40 | +Define the `VirtualService` resource in order to establish the Ingress Gateway routing to the Online Boutique apps: |
| 41 | +```Bash |
| 42 | +cat <<EOF > ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/base/virtualservice.yaml |
| 43 | +apiVersion: networking.istio.io/v1alpha3 |
| 44 | +kind: VirtualService |
| 45 | +metadata: |
| 46 | + name: frontend |
| 47 | +spec: |
| 48 | + hosts: |
| 49 | + - "*" |
| 50 | + gateways: |
| 51 | + - ${INGRESS_GATEWAY_NAMESPACE}/${INGRESS_GATEWAY_NAME} |
| 52 | + http: |
| 53 | + - route: |
| 54 | + - destination: |
| 55 | + host: frontend |
| 56 | + port: |
| 57 | + number: 80 |
| 58 | +EOF |
| 59 | +``` |
53 | 60 |
|
54 | | -Update the overlay files needed to define the Staging namespace: |
| 61 | +Update the Kustomize base overlay: |
55 | 62 | ```Bash |
56 | | -cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/staging |
57 | | -kustomize edit add resource ../base |
58 | | -kustomize edit set namespace $ONLINEBOUTIQUE_NAMESPACE |
59 | | -cp -r ../upstream/base/for-virtualservice-host/ . |
60 | | -sed -i "s/HOST_NAME/${ONLINE_BOUTIQUE_INGRESS_GATEWAY_HOST_NAME}/g" for-virtualservice-host/kustomization.yaml |
61 | | -kustomize edit add component for-virtualservice-host |
| 63 | +cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/base |
| 64 | +kustomize edit add resource virtualservice.yaml |
62 | 65 | ``` |
63 | 66 |
|
64 | | -Update the `Deployments`'s container images to point to the private Artifact Registry: |
| 67 | +## Update the Staging namespace overlay |
| 68 | + |
| 69 | +Update the Staging Kustomize overlay with the proper `hosts` value in the `VirtualService` and with the `Deployments`'s container images to point to the private Artifact Registry: |
65 | 70 | ```Bash |
66 | | -cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/staging |
67 | 71 | cat <<EOF >> ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME/staging/kustomization.yaml |
68 | 72 | patchesJson6902: |
| 73 | +- target: |
| 74 | + kind: VirtualService |
| 75 | + name: frontend |
| 76 | + patch: |- |
| 77 | + - op: replace |
| 78 | + path: /spec/hosts |
| 79 | + value: |
| 80 | + - ${ONLINE_BOUTIQUE_INGRESS_GATEWAY_HOST_NAME} |
69 | 81 | - target: |
70 | 82 | kind: Deployment |
71 | 83 | name: adservice |
@@ -166,37 +178,36 @@ git add . && git commit -m "Online Boutique apps" && git push origin main |
166 | 178 | ## Check deployments |
167 | 179 |
|
168 | 180 | List the Kubernetes resources managed by Config Sync in **GKE cluster** for the **Online Boutique apps** repository: |
| 181 | +{{< tabs groupId="cs-status-ui">}} |
| 182 | +{{% tab name="gcloud" %}} |
169 | 183 | ```Bash |
170 | 184 | gcloud alpha anthos config sync repo describe \ |
171 | 185 | --project $TENANT_PROJECT_ID \ |
172 | 186 | --managed-resources all \ |
173 | 187 | --sync-name repo-sync \ |
174 | 188 | --sync-namespace $ONLINEBOUTIQUE_NAMESPACE |
175 | 189 | ``` |
176 | | -Wait and re-run this command above until you see `"status": "SYNCED"`. All the `managed_resources` listed should have `STATUS: Current` as well. |
177 | | - |
178 | | -List the GitHub runs for the **Online Boutique apps** repository: |
| 190 | +Wait and re-run this command above until you see `"status": "SYNCED"`. |
| 191 | +{{% /tab %}} |
| 192 | +{{% tab name="UI" %}} |
| 193 | +Alternatively, you could also see this from within the Cloud Console, by clicking on this link: |
179 | 194 | ```Bash |
180 | | -cd ${WORK_DIR}$ONLINE_BOUTIQUE_DIR_NAME && gh run list |
| 195 | +echo -e "https://console.cloud.google.com/kubernetes/config_management/status?clusterName=${GKE_NAME}&id=${GKE_NAME}&project=${TENANT_PROJECT_ID}" |
181 | 196 | ``` |
| 197 | +Wait until you see the `Sync status` column as `SYNCED`. And then you can also click on `View resources` to see the details. |
| 198 | +{{% /tab %}} |
| 199 | +{{< /tabs >}} |
182 | 200 |
|
183 | 201 | ## Check the Online Boutique apps |
184 | 202 |
|
185 | | -Navigate to the Online Boutique apps, click on the link displayed by the command below: |
186 | | -```Bash |
187 | | -echo -e "https://${ONLINE_BOUTIQUE_INGRESS_GATEWAY_HOST_NAME}" |
188 | | -``` |
189 | | - |
190 | | -You will see that the Online Boutique website is not working. |
191 | | - |
192 | | -Open the list of the **Workloads** deployed in the GKE cluster, click on the link displayed by the command below: |
| 203 | +Open the list of the **Workloads** deployed in the GKE cluster, you will see that the Online Boutique apps is successfully deployed. Click on the link displayed by the command below: |
193 | 204 | ```Bash |
194 | 205 | echo -e "https://console.cloud.google.com/kubernetes/workload/overview?project=${TENANT_PROJECT_ID}" |
195 | 206 | ``` |
196 | 207 |
|
197 | | -Here you could see that all the Online Boutique `Deployments` are in `Error`. If you look at more details on the `Pods` you will see this error: |
198 | | -```Plaintext |
199 | | -Readiness probe failed: Get "http://10.4.2.13:15020/app-health/server/readyz": dial tcp 10.4.2.13:15020: connect: connection refused |
| 208 | +Navigate to the Online Boutique apps, click on the link displayed by the command below: |
| 209 | +```Bash |
| 210 | +echo -e "https://${ONLINE_BOUTIQUE_INGRESS_GATEWAY_HOST_NAME}" |
200 | 211 | ``` |
201 | 212 |
|
202 | | -At this stage, that's expected because we have deployed the `deny-all` `NetworkPolicy` in the `onlineboutique` `Namespace` blocking any ingress and egress requests to and from any app in this `Namespace`. We will fix this in the next sections. |
| 213 | +You should receive the error: `RBAC: access denied`. This is because the default deny-all `AuthorizationPolicy` has been applied to the entire mesh. In the next section you will apply a fine granular `AuthorizationPolicy` for the Online Boutique apps in order to get fix this. |
0 commit comments