Skip to content

Clean-up fixes for deploy and configure doc #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
liwenwu-amazon merged 1 commit into from
Mar 14, 2023
Merged

Clean-up fixes for deploy and configure doc #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 18 additions & 22 deletions docs/configure.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@ This example creates a single cluster in a single VPC, then configures two route
kubectl get gateway
```
```
NAME CLASS ADDRESS READY AGE
my-hotel aws-lattice 7d12h
NAME CLASS ADDRESS READY AGE
my-hotel amazon-vpc-lattice 7d12h
```
1. Once the gateway is created, find the VPC Lattice service network:
```bash
Expand Down Expand Up @@ -83,30 +83,26 @@ This example creates a single cluster in a single VPC, then configures two route
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"gateway.networking.k8s.io/v1alpha2","kind":"HTTPRoute","metadata":{"annotations":{},"name":"inventory","namespace":"default"}... }}]}]}}
...
status:
parents:
- conditions:
- lastTransitionTime: "2022-11-22T02:29:22Z"
message: 'DNS Name: <b><i>inventory-default-0f326944c3d681c0d.7d67968.vpc-lattice-svcs.us-west-2.on.aws</i></b>'
reason: Reconciled
status: "True"
type: httproute
controllerName: application-networking.k8s.aws/gateway-api-controller
parentRef:
group: gateway.networking.k8s.io
kind: Gateway
name: my-hotel
annotations:
application-networking.k8s.aws/lattice-assigned-domain-name: inventory-default-02fb06f1acdeb5b55.7d67968.vpc-lattice-svcs.us-west-2.on.aws
...
```

```bash
kubectl get httproute rates inventory -o yaml
```

```
apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
annotations:
application-networking.k8s.aws/lattice-assigned-domain-name: rates-default-0d38139624f20d213.7d67968.vpc-lattice-svcs.us-west-2.on.aws
...
```

**Check service connectivity**

1. Check Service-Inventory Pod access for Service-Rates/parking or Service-Rates/review by execing into the pod, then curling each service.
Expand All @@ -128,7 +124,7 @@ This example creates a single cluster in a single VPC, then configures two route
```
1. From inside of the inventory pod, use `curl` to connect to the parking service (using the DNS Name from the previous `kubectl get httproute` command):
```bash
curl rates-00422586e3362607e.7d67968.vpc-service-network-svcs.us-west-2.amazonaws.com/parking
curl rates-default-0d38139624f20d213.7d67968.vpc-lattice-svcs.us-west-2.on.aws/parking
```
```
Requesting to Pod(parking-6cdcd5b4b4-g8dkb): parking handler pod
Expand All @@ -150,7 +146,7 @@ This example creates a single cluster in a single VPC, then configures two route
```
1. From inside of the parking pod, use `curl` to connect to the inventory-ver1 service:
```bash
curl inventory-00422586e3362607e.7d67968.vpc-service-network-svcs.us-west-2.amazonaws.com
curl inventory-default-02fb06f1acdeb5b55.7d67968.vpc-lattice-svcs.us-west-2.on.aws
```
```
Requesting to Pod(inventory-ver1-7bb6989d9d-2p2hk): inventory-ver1 handler pod
Expand Down Expand Up @@ -223,4 +219,4 @@ The following figure illustrates this:
Requsting to Pod(inventory-ver2-6dc74b45d8-95rsr): Inventory-ver2 handler pod
Requsting to Pod(inventory-ver1-74fc59977-wg8br): Inventory-ver1 handler pod....
```
You can see that the traffic is distributed between *inventory-ver1* and *inventory-ver2* as expected.
You can see that the traffic is distributed between *inventory-ver1* and *inventory-ver2* as expected.
13 changes: 7 additions & 6 deletions docs/deploy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,24 +3,25 @@
Follow these instructions to create a cluster and deploy the AWS Gateway API Controller.
Run through them again for a second cluster to use with the extended example shown later.

1. Set your region as an environment variable. Nine regions are now supported, including `us-west-2` and `us-east-1`. For example:
1. Set your region and cluster name as environment variables. Nine regions are now supported, including `us-west-2` and `us-east-1`. For example:
```bash
export AWS_REGION=us-west-2
export CLUSTER_NAME=my-cluster
```
1. You can use an existing EKS cluster or create a new one as shown here:
```bash
eksctl create cluster --name <my-cluster> --region $AWS_REGION
eksctl create cluster --name $CLUSTER_NAME --region $AWS_REGION
```
1. First, configure security group to receive traffic from the VPC Lattice fleet. You must set up security groups so that they allow all Pods communicating with VPC Lattice to allow traffic on all ports from the `169.254.171.0/24` address range.

```bash
MANAGED_PREFIX=$(aws ec2 get-managed-prefix-list-entries --region $AWS_DEFAULT_REGION --prefix-list-id pl-0721453c7ac4ec009 | jq -r '.Entries[0].Cidr')
CLUSTER_SG=$(aws eks describe-cluster --name <my-cluster> | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId')
MANAGED_PREFIX=$(aws ec2 get-managed-prefix-list-entries --region $AWS_REGION --prefix-list-id pl-0721453c7ac4ec009 | jq -r '.Entries[0].Cidr')
CLUSTER_SG=$(aws eks describe-cluster --name $CLUSTER_NAME | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId')
aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --cidr $MANAGED_PREFIX --protocol -1
```
1. Create an IAM OIDC provider: See [Creating an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) for details.
```bash
eksctl utils associate-iam-oidc-provider --cluster <my-cluster> --approve
eksctl utils associate-iam-oidc-provider --cluster $CLUSTER_NAME --approve --region $AWS_REGION
```
1. Create a policy (`recommended-inline-policy.json`) in IAM with the following content that can invoke the gateway API and copy the policy arn for later use:
```bash
Expand Down Expand Up @@ -56,7 +57,7 @@ Run through them again for a second cluster to use with the extended example sho
1. Create an iamserviceaccount for pod level permission:
```bash
eksctl create iamserviceaccount \
--cluster=<my-cluster> \
--cluster=$CLUSTER_NAME \
--namespace=system \
--name=gateway-api-controller \
--attach-policy-arn=$VPCLatticeControllerIAMPolicyArn \
Expand Down