diff --git a/docs/deploy.md b/docs/deploy.md index fd42ce57..fe6b3a78 100644 --- a/docs/deploy.md +++ b/docs/deploy.md @@ -13,21 +13,15 @@ Run through them again for a second cluster to use with the extended example sho eksctl create cluster --name $CLUSTER_NAME --region $AWS_REGION ``` 1. First, configure security group to receive traffic from the VPC Lattice fleet. You must set up security groups so that they allow all Pods communicating with VPC Lattice to allow traffic on all ports from the `169.254.171.0/24` address range. - ```bash MANAGED_PREFIX=$(aws ec2 get-managed-prefix-list-entries --region $AWS_REGION --prefix-list-id pl-0721453c7ac4ec009 | jq -r '.Entries[0].Cidr') CLUSTER_SG=$(aws eks describe-cluster --name $CLUSTER_NAME | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId') aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --cidr $MANAGED_PREFIX --protocol -1 - ``` - 1. Create an IAM OIDC provider: See [Creating an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) for details. - ```bash eksctl utils associate-iam-oidc-provider --cluster $CLUSTER_NAME --approve --region $AWS_REGION ``` - 1. Create a policy (`recommended-inline-policy.json`) in IAM with the following content that can invoke the gateway API and copy the policy arn for later use: - ```bash { "Version": "2012-10-17", @@ -51,19 +45,14 @@ Run through them again for a second cluster to use with the extended example sho --policy-document file://examples/recommended-inline-policy.json ``` 1. Create the `system` namespace: - ```bash kubectl apply -f examples/deploy-namesystem.yaml ``` - 1. Retrieve the policy ARN: - ```bash export VPCLatticeControllerIAMPolicyArn=$(aws iam list-policies --query 'Policies[?PolicyName==`VPCLatticeControllerIAMPolicy`].Arn' --output text) ``` - 1. Create an iamserviceaccount for pod level permission: - ```bash eksctl create iamserviceaccount \ --cluster=$CLUSTER_NAME \ @@ -74,15 +63,11 @@ Run through them again for a second cluster to use with the extended example sho --region $AWS_REGION \ --approve ``` - 1. Run either `kubectl` or `helm` to deploy the controller: - ```bash kubectl apply -f examples/deploy-v0.0.4.yaml ``` - or - ```bash # login to ECR aws ecr-public get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin public.ecr.aws @@ -92,7 +77,6 @@ Run through them again for a second cluster to use with the extended example sho --version=v0.0.3 \ --set=aws.region=$AWS_REGION --set=serviceAccount.create=false --namespace system ``` - 1. Create the `amazon-vpc-lattice` GatewayClass: ```bash kubectl apply -f examples/gatewayclass.yaml diff --git a/docs/getstarted.md b/docs/getstarted.md index cb3e6b36..e52d7bb0 100644 --- a/docs/getstarted.md +++ b/docs/getstarted.md @@ -1,12 +1,12 @@ # Get Start Using the AWS Gateway API Controller -Once you have [deployed the AWS Gateway API Controller](configure/index.md), this guide helps you get started using the controller. +Once you have [deployed the AWS Gateway API Controller](deploy.md), this guide helps you get started using the controller. The first part of this section provides an example of setting up of service-to-service communications on a single cluster. The second section extends that example by creating another inventory service on a second cluster on a different VPC, and spreading traffic to that service across the two clusters and VPCs. Both clusters are created using `eksctl`, with both clusters created from the same account by the same cluster admin. -Using these examples as a foundation, see the +Using these examples as a foundation, see the [Configuration](configure/index.md)) section for ways to further configure service-to-service communications. ## Set up single-cluster/VPC service-to-service communications @@ -19,13 +19,10 @@ This example creates a single cluster in a single VPC, then configures two route **Set up Service-to-Service communications** 1. Create the Kubernetes Gateway `my-hotel`: - ```bash kubectl apply -f examples/my-hotel-gateway.yaml ``` - ***Note***: By default, the gateway (lattice service network) is not associated with cluster's VPC. To associate a gateway (lattice service network) to VPC, `my-hotel-gateway.yaml` includes the following annotation. - ``` apiVersion: gateway.networking.k8s.io/v1beta1 kind: Gateway @@ -34,7 +31,6 @@ This example creates a single cluster in a single VPC, then configures two route annotations: application-networking.k8s.aws/lattice-vpc-association: "true" ``` - 1. Verify that `my-hotel` gateway is created (this could take about five minutes): ```bash kubectl get gateway @@ -79,11 +75,9 @@ This example creates a single cluster in a single VPC, then configures two route rates 6m11s ``` 1. List the route’s yaml file to see the DNS address (highlighted here on the `message` line): - ```bash kubectl get httproute inventory -o yaml ``` - ``` apiVersion: gateway.networking.k8s.io/v1beta1 kind: HTTPRoute @@ -96,7 +90,6 @@ This example creates a single cluster in a single VPC, then configures two route ```bash kubectl get httproute rates -o yaml ``` - ``` apiVersion: v1 items: