Skip to content
This repository was archived by the owner on Dec 22, 2022. It is now read-only.

Commit fc7f18a

Browse files
author
Mathieu Benoit
committed
managed asm
1 parent bc32403 commit fc7f18a

File tree

8 files changed

+70
-38
lines changed

8 files changed

+70
-38
lines changed

‎content/deploy-workloads/ingress-gateway.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ In this section, you will deploy the Ingress Gateway in its own namespace as you
77
Init variables:
88
```Bash
99
export INGRESS_GATEWAY_NAMESPACE=asm-ingress
10-
export ASM_VERSION=$(kubectl get deploy -n istio-system -l app=istiod -o jsonpath={.items[*].metadata.labels.'istio\.io\/rev'}'{"\n"}')
1110
export INGRESS_GATEWAY_NAME=asm-ingressgateway
1211
export INGRESS_GATEWAY_LABEL="asm: ingressgateway"
1312
```
@@ -19,6 +18,8 @@ apiVersion: v1
1918
kind: Namespace
2019
metadata:
2120
name: ${INGRESS_GATEWAY_NAMESPACE}
21+
annotations:
22+
mesh.cloud.google.com/proxy: '{"managed": true}'
2223
labels:
2324
name: ${INGRESS_GATEWAY_NAMESPACE}
2425
istio.io/rev: ${ASM_VERSION}

‎content/deploy-workloads/onlineboutique.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,14 @@ In this section, you will deploy the [OnlineBoutique](https://github.com/GoogleC
66

77
```Bash
88
export ONLINEBOUTIQUE_NAMESPACE=onlineboutique
9-
kubectl create namespace $ONLINEBOUTIQUE_NAMESPACE
9+
cat <<EOF | kubectl apply -n $ONLINEBOUTIQUE_NAMESPACE -f -
10+
apiVersion: v1
11+
kind: Namespace
12+
metadata:
13+
name: ${ONLINEBOUTIQUE_NAMESPACE}
14+
labels:
15+
name: ${ONLINEBOUTIQUE_NAMESPACE}
16+
EOF
1017
curl -LO https://raw.githubusercontent.com/GoogleCloudPlatform/microservices-demo/master/release/kubernetes-manifests.yaml > ~/$WORKING_DIRECTORY/onlineboutique.yaml
1118
kubectl apply -f ~/$WORKING_DIRECTORY/onlineboutique.yaml -n $ONLINEBOUTIQUE_NAMESPACE
1219
```

‎content/enable-asm/onlineboutique.md‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,17 @@ In this section, you will enable ASM for OnlineBoutique.
66

77
Inject the Istio/ASM proxy within the OnlineBoutique namespace:
88
```Bash
9-
ASM_VERSION=$(kubectl get deploy -n istio-system -l app=istiod -o jsonpath={.items[*].metadata.labels.'istio\.io\/rev'}'{"\n"}')
10-
kubectl label namespace $ONLINEBOUTIQUE_NAMESPACE istio-injection- istio.io/rev=$ASM_VERSION --overwrite
9+
cat <<EOF | kubectl apply -n $ONLINEBOUTIQUE_NAMESPACE -f -
10+
apiVersion: v1
11+
kind: Namespace
12+
metadata:
13+
name: ${ONLINEBOUTIQUE_NAMESPACE}
14+
annotations:
15+
mesh.cloud.google.com/proxy: '{"managed": true}'
16+
labels:
17+
name: ${ONLINEBOUTIQUE_NAMESPACE}
18+
istio.io/rev: ${ASM_VERSION}
19+
EOF
1120
kubectl rollout restart deployments -n $ONLINEBOUTIQUE_NAMESPACE
1221
```
1322

‎content/install-asm/install-asm.md‎

Lines changed: 38 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -9,49 +9,57 @@ curl https://storage.googleapis.com/csm-artifacts/asm/asmcli_1.12 > ~/asmcli
99
chmod +x ~/asmcli
1010
```
1111

12+
Enable Managed ASM on your current project:
13+
```Bash
14+
gcloud container hub mesh enable
15+
```
16+
1217
Run the `asmcli install` command:
1318
```Bash
14-
cat <<EOF > distroless-proxy.yaml
15-
---
16-
apiVersion: install.istio.io/v1alpha1
17-
kind: IstioOperator
18-
spec:
19-
meshConfig:
20-
defaultConfig:
21-
image:
22-
imageType: distroless
23-
EOF
19+
ASM_CHANNEL=rapid
20+
ASM_LABEL=asm-managed
21+
export ASM_VERSION=$ASM_LABEL-$ASM_CHANNEL
2422
~/asmcli install \
2523
--project_id $PROJECT_ID \
2624
--cluster_name $GKE_NAME \
2725
--cluster_location $ZONE \
2826
--enable-all \
29-
--option cloud-tracing \
30-
--option cni-gcp \
31-
--custom_overlay distroless-proxy.yaml
27+
--managed \
28+
--channel $ASM_CHANNEL \
29+
--use_managed_cni
3230
```
3331

34-
Ensure that all deployments are up and running:
32+
Apply the following Mesh configs (`distroless` container image for the proxy and Cloud Tracing):
3533
```Bash
36-
kubectl wait --for=condition=available --timeout=600s deployment --all -n istio-system
37-
kubectl wait --for=condition=available --timeout=600s deployment --all -n asm-system
34+
cat <<EOF | kubectl apply -n istio-system -f -
35+
apiVersion: v1
36+
kind: Namespace
37+
metadata:
38+
name: istio-system
39+
---
40+
apiVersion: v1
41+
data:
42+
mesh: |-
43+
defaultConfig:
44+
image:
45+
imageType: distroless
46+
tracing:
47+
stackdriver:{}
48+
kind: ConfigMap
49+
metadata:
50+
name: istio-${ASM_VERSION}
51+
EOF
3852
```
3953

40-
_Not part of the workshop, but here below is the routine when you will need to run to [upgrade to a newer version of ASM](https://cloud.google.com/service-mesh/docs/unified-install/plan-upgrade):_
54+
Ensure that all deployments are up and running:
4155
```Bash
42-
# Grab the current ASM version before upgrading to the new version
43-
OLD_ASM_VERSION=$(kubectl get deploy -n istio-system -l app=istiod -o jsonpath={.items[*].metadata.labels.'istio\.io\/rev'}'{"\n"}')
44-
# Doownload the new version of the `asmcli` tool
45-
curl https://storage.googleapis.com/csm-artifacts/asm/asmcli_1.12 > ~/asmcli
46-
chmod +x ~/asmcli
47-
# Run the same `asmcli install` command we ran for the installation
48-
~/asmcli install...
49-
# Update the asm/istio labels of your namespaces
50-
kubectl rollout restart deployments -n FIXME
51-
# Once you have verified that your workloads and ASM is working properly, you could complete the upgrade of ASM by removing the the components of the old version
52-
kubectl delete Service,Deployment,HorizontalPodAutoscaler,PodDisruptionBudget istiod-$OLD_ASM_VERSION -n istio-system --ignore-not-found=true
53-
kubectl delete IstioOperator installed-state-$OLD_ASM_VERSION -n istio-system
56+
kubectl get controlplanerevision -n istio-system
57+
kubectl get dataplanecontrols
58+
kubectl get daemonset istio-cni-node -n kube-system
59+
kubectl wait --for=condition=available --timeout=600s deployment --all -n asm-system
5460
```
5561

5662
Resources:
57-
- [Install ASM](https://cloud.google.com/service-mesh/docs/unified-install/install)
63+
- [ASM Release Notes](https://cloud.google.com/service-mesh/docs/release-notes)
64+
- [Configure Managed Anthos Service Mesh](https://cloud.google.com/service-mesh/docs/managed/service-mesh)
65+
- [Managed ASM Release Channel](https://cloud.google.com/service-mesh/docs/managed/release-channels)

‎content/overview/before-you-begin.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ cd $WORKING_DIRECTORY
1414
```
1515

1616
Install the required tools:
17-
- `gcloud`
18-
- `kubectl`
17+
- [`gcloud`](https://cloud.google.com/sdk/docs/install)
18+
- [`kubectl`](https://kubernetes.io/docs/tasks/tools/#kubectl)
1919
- `istioctl`
2020
- `curl`
2121

‎content/overview/objectives.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ This workshop is not an introduction to Istio nor Anthos Service Mesh (ASM), if
99

1010
Agenda:
1111
- Create a GKE cluster
12-
- Install a secure ASM (Istio CNI, `distroless` proxy container image)
12+
- Install a secure Managed ASM (Managed Control Plane, Managed Data Plane, Istio CNI and `distroless` proxy container image)
1313
- Deploy workloads (OnlineBoutique)
1414
- Enable ASM for workloads (sidecar proxy injection)
1515
- Configure mTLS STRICT

‎content/secure-ingress/asm-ingress.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,4 +88,8 @@ spec:
8888
EOF
8989
```
9090

91+
```Bash
92+
kubectl get managedcertificate ${INGRESS_GATEWAY_NAME} -ojsonpath='{.status.certificateStatus}' -n $INGRESS_GATEWAY_NAMESPACE
93+
```
94+
9195
FIXME - add a section with unprivileged deployment too + Rk about PSC/Internal LB.

‎content/secure-ingress/cloud-armor.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,7 @@ export SSL_POLICY_NAME=$SECURITY_POLICY_NAME
2525
gcloud compute ssl-policies create $SSL_POLICY_NAME \
2626
--profile COMPATIBLE \
2727
--min-tls-version 1.0
28-
```
28+
```
29+
30+
Resources:
31+
- [Google Cloud Armor WAF rule to help mitigate Apache Log4j vulnerability](https://cloud.google.com/blog/products/identity-security/cloud-armor-waf-rule-to-help-address-apache-log4j-vulnerability)

0 commit comments

Comments
 (0)