From 186df70812e487d4b008fe250c78379fc8edb15b Mon Sep 17 00:00:00 2001 From: Christopher Negus Date: Tue, 14 Mar 2023 15:45:54 +0000 Subject: [PATCH] Clean-up fixes for deploy and configure doc --- docs/configure.md | 40 ++++++++++++++++++---------------------- docs/deploy.md | 13 +++++++------ 2 files changed, 25 insertions(+), 28 deletions(-) diff --git a/docs/configure.md b/docs/configure.md index 7727d9dc..2f876885 100644 --- a/docs/configure.md +++ b/docs/configure.md @@ -36,8 +36,8 @@ This example creates a single cluster in a single VPC, then configures two route kubectl get gateway ``` ``` - NAME CLASS ADDRESS READY AGE - my-hotel aws-lattice 7d12h + NAME CLASS ADDRESS READY AGE + my-hotel amazon-vpc-lattice 7d12h ``` 1. Once the gateway is created, find the VPC Lattice service network: ```bash @@ -83,23 +83,8 @@ This example creates a single cluster in a single VPC, then configures two route apiVersion: gateway.networking.k8s.io/v1alpha2 kind: HTTPRoute metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"gateway.networking.k8s.io/v1alpha2","kind":"HTTPRoute","metadata":{"annotations":{},"name":"inventory","namespace":"default"}... }}]}]}} - ... - status: - parents: - - conditions: - - lastTransitionTime: "2022-11-22T02:29:22Z" - message: 'DNS Name: inventory-default-0f326944c3d681c0d.7d67968.vpc-lattice-svcs.us-west-2.on.aws' - reason: Reconciled - status: "True" - type: httproute - controllerName: application-networking.k8s.aws/gateway-api-controller - parentRef: - group: gateway.networking.k8s.io - kind: Gateway - name: my-hotel + annotations: + application-networking.k8s.aws/lattice-assigned-domain-name: inventory-default-02fb06f1acdeb5b55.7d67968.vpc-lattice-svcs.us-west-2.on.aws ... ``` @@ -107,6 +92,17 @@ This example creates a single cluster in a single VPC, then configures two route kubectl get httproute rates inventory -o yaml ``` + ``` + apiVersion: v1 + items: + - apiVersion: gateway.networking.k8s.io/v1alpha2 + kind: HTTPRoute + metadata: + annotations: + application-networking.k8s.aws/lattice-assigned-domain-name: rates-default-0d38139624f20d213.7d67968.vpc-lattice-svcs.us-west-2.on.aws + ... + ``` + **Check service connectivity** 1. Check Service-Inventory Pod access for Service-Rates/parking or Service-Rates/review by execing into the pod, then curling each service. @@ -128,7 +124,7 @@ This example creates a single cluster in a single VPC, then configures two route ``` 1. From inside of the inventory pod, use `curl` to connect to the parking service (using the DNS Name from the previous `kubectl get httproute` command): ```bash - curl rates-00422586e3362607e.7d67968.vpc-service-network-svcs.us-west-2.amazonaws.com/parking + curl rates-default-0d38139624f20d213.7d67968.vpc-lattice-svcs.us-west-2.on.aws/parking ``` ``` Requesting to Pod(parking-6cdcd5b4b4-g8dkb): parking handler pod @@ -150,7 +146,7 @@ This example creates a single cluster in a single VPC, then configures two route ``` 1. From inside of the parking pod, use `curl` to connect to the inventory-ver1 service: ```bash - curl inventory-00422586e3362607e.7d67968.vpc-service-network-svcs.us-west-2.amazonaws.com + curl inventory-default-02fb06f1acdeb5b55.7d67968.vpc-lattice-svcs.us-west-2.on.aws ``` ``` Requesting to Pod(inventory-ver1-7bb6989d9d-2p2hk): inventory-ver1 handler pod @@ -223,4 +219,4 @@ The following figure illustrates this: Requsting to Pod(inventory-ver2-6dc74b45d8-95rsr): Inventory-ver2 handler pod Requsting to Pod(inventory-ver1-74fc59977-wg8br): Inventory-ver1 handler pod.... ``` - You can see that the traffic is distributed between *inventory-ver1* and *inventory-ver2* as expected. \ No newline at end of file + You can see that the traffic is distributed between *inventory-ver1* and *inventory-ver2* as expected. diff --git a/docs/deploy.md b/docs/deploy.md index 697a1a35..e42cc6c3 100644 --- a/docs/deploy.md +++ b/docs/deploy.md @@ -3,24 +3,25 @@ Follow these instructions to create a cluster and deploy the AWS Gateway API Controller. Run through them again for a second cluster to use with the extended example shown later. -1. Set your region as an environment variable. Nine regions are now supported, including `us-west-2` and `us-east-1`. For example: +1. Set your region and cluster name as environment variables. Nine regions are now supported, including `us-west-2` and `us-east-1`. For example: ```bash export AWS_REGION=us-west-2 + export CLUSTER_NAME=my-cluster ``` 1. You can use an existing EKS cluster or create a new one as shown here: ```bash - eksctl create cluster --name --region $AWS_REGION + eksctl create cluster --name $CLUSTER_NAME --region $AWS_REGION ``` 1. First, configure security group to receive traffic from the VPC Lattice fleet. You must set up security groups so that they allow all Pods communicating with VPC Lattice to allow traffic on all ports from the `169.254.171.0/24` address range. ```bash - MANAGED_PREFIX=$(aws ec2 get-managed-prefix-list-entries --region $AWS_DEFAULT_REGION --prefix-list-id pl-0721453c7ac4ec009 | jq -r '.Entries[0].Cidr') - CLUSTER_SG=$(aws eks describe-cluster --name | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId') + MANAGED_PREFIX=$(aws ec2 get-managed-prefix-list-entries --region $AWS_REGION --prefix-list-id pl-0721453c7ac4ec009 | jq -r '.Entries[0].Cidr') + CLUSTER_SG=$(aws eks describe-cluster --name $CLUSTER_NAME | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId') aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --cidr $MANAGED_PREFIX --protocol -1 ``` 1. Create an IAM OIDC provider: See [Creating an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) for details. ```bash - eksctl utils associate-iam-oidc-provider --cluster --approve + eksctl utils associate-iam-oidc-provider --cluster $CLUSTER_NAME --approve --region $AWS_REGION ``` 1. Create a policy (`recommended-inline-policy.json`) in IAM with the following content that can invoke the gateway API and copy the policy arn for later use: ```bash @@ -56,7 +57,7 @@ Run through them again for a second cluster to use with the extended example sho 1. Create an iamserviceaccount for pod level permission: ```bash eksctl create iamserviceaccount \ - --cluster= \ + --cluster=$CLUSTER_NAME \ --namespace=system \ --name=gateway-api-controller \ --attach-policy-arn=$VPCLatticeControllerIAMPolicyArn \