The purpose of this repository is to show benefits of service mesh when running container workloads.
- Authentication and encryption
- Authorisation
- Accounting
- Record keeping
The exercises can be run on any Kubernetes cluster, though they have been only tested on
minikube
.
All examples have been wrapped with a Makefile
.
Tasks:
make minikube
- start/create aminikube
clustermake download-istio
- downloadIstio
to current directory
All exercises will be based on simple bookinfo
application, formed with 4 microservices.
Pods can access each other without any restrictions.
make app
- deploybookinfo
applicationmake node-port
- expose application on node portmake test-non-authenticated-access
- deploy pod in separate namespace and test connection
Istio is deployed. Pods outside the mesh can't access pods inside the mesh.
make istio
- deployIstio
make app-istio
- deploy ingress gateway and destination rules (+ restart pods to inject sidecars)make test-non-authenticated-access
- deploy pod in separate namespace and test connectionmake test-access
- get on a productpage sidecar and curl reviews service using certificatesmake test-access-no-certs
- get on a productpage sidecar and curl reviews service without a certificatemake test-identity
- check identity of sidecar certificatemake test-validity
- check validity of sidecar certificate
make istio-rbac
- enable RBAC in default namespacemake istio-rbac-service-level
- allow access to services
make kiali
- openkiali
dashboardmake jeager
- openjeager
dashboardmake grafana
- opengrafana
dashboardmake app-istio-break-details-service
- makedetails
service unavailable
make sleep-pod
- deploy test pod in the mesh for curl requestsmake test-outbound-google
- curl https://www.google.commake test-outbound-wikipedia
- curl https://en.wikipedia.org/wiki/Main_Pagemake istio-block-outbound
- Block all outbound traffic by defaultmake istio-allow-google
- Allow only access to https://www.google.com