Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 0 additions & 16 deletions docs/deploy.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,21 +13,15 @@ Run through them again for a second cluster to use with the extended example sho
eksctl create cluster --name $CLUSTER_NAME --region $AWS_REGION
```
1. First, configure security group to receive traffic from the VPC Lattice fleet. You must set up security groups so that they allow all Pods communicating with VPC Lattice to allow traffic on all ports from the `169.254.171.0/24` address range.

```bash
MANAGED_PREFIX=$(aws ec2 get-managed-prefix-list-entries --region $AWS_REGION --prefix-list-id pl-0721453c7ac4ec009 | jq -r '.Entries[0].Cidr')
CLUSTER_SG=$(aws eks describe-cluster --name $CLUSTER_NAME | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId')
aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --cidr $MANAGED_PREFIX --protocol -1
```

1. Create an IAM OIDC provider: See [Creating an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) for details.

```bash
eksctl utils associate-iam-oidc-provider --cluster $CLUSTER_NAME --approve --region $AWS_REGION
```

1. Create a policy (`recommended-inline-policy.json`) in IAM with the following content that can invoke the gateway API and copy the policy arn for later use:

```bash
{
"Version": "2012-10-17",
Expand All @@ -51,19 +45,14 @@ Run through them again for a second cluster to use with the extended example sho
--policy-document file://examples/recommended-inline-policy.json
```
1. Create the `system` namespace:

```bash
kubectl apply -f examples/deploy-namesystem.yaml
```

1. Retrieve the policy ARN:

```bash
export VPCLatticeControllerIAMPolicyArn=$(aws iam list-policies --query 'Policies[?PolicyName==`VPCLatticeControllerIAMPolicy`].Arn' --output text)
```

1. Create an iamserviceaccount for pod level permission:

```bash
eksctl create iamserviceaccount \
--cluster=$CLUSTER_NAME \
Expand All @@ -74,15 +63,11 @@ Run through them again for a second cluster to use with the extended example sho
--region $AWS_REGION \
--approve
```

1. Run either `kubectl` or `helm` to deploy the controller:

```bash
kubectl apply -f examples/deploy-v0.0.4.yaml
```

or

```bash
# login to ECR
aws ecr-public get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin public.ecr.aws
Expand All @@ -92,7 +77,6 @@ Run through them again for a second cluster to use with the extended example sho
--version=v0.0.3 \
--set=aws.region=$AWS_REGION --set=serviceAccount.create=false --namespace system
```

1. Create the `amazon-vpc-lattice` GatewayClass:
```bash
kubectl apply -f examples/gatewayclass.yaml
Expand Down
11 changes: 2 additions & 9 deletions docs/getstarted.md
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# Get Start Using the AWS Gateway API Controller

Once you have [deployed the AWS Gateway API Controller](configure/index.md), this guide helps you get started using the controller.
Once you have [deployed the AWS Gateway API Controller](deploy.md), this guide helps you get started using the controller.

The first part of this section provides an example of setting up of service-to-service communications on a single cluster.
The second section extends that example by creating another inventory service on a second cluster on a different VPC, and spreading traffic to that service across the two clusters and VPCs.
Both clusters are created using `eksctl`, with both clusters created from the same account by the same cluster admin.

Using these examples as a foundation, see the
Using these examples as a foundation, see the [Configuration](configure/index.md)) section for ways to further configure service-to-service communications.

## Set up single-cluster/VPC service-to-service communications

Expand All @@ -19,13 +19,10 @@ This example creates a single cluster in a single VPC, then configures two route
**Set up Service-to-Service communications**

1. Create the Kubernetes Gateway `my-hotel`:

```bash
kubectl apply -f examples/my-hotel-gateway.yaml
```

***Note***: By default, the gateway (lattice service network) is not associated with cluster's VPC. To associate a gateway (lattice service network) to VPC, `my-hotel-gateway.yaml` includes the following annotation.

```
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
Expand All @@ -34,7 +31,6 @@ This example creates a single cluster in a single VPC, then configures two route
annotations:
application-networking.k8s.aws/lattice-vpc-association: "true"
```

1. Verify that `my-hotel` gateway is created (this could take about five minutes):
```bash
kubectl get gateway
Expand Down Expand Up @@ -79,11 +75,9 @@ This example creates a single cluster in a single VPC, then configures two route
rates 6m11s
```
1. List the route’s yaml file to see the DNS address (highlighted here on the `message` line):

```bash
kubectl get httproute inventory -o yaml
```

```
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
Expand All @@ -96,7 +90,6 @@ This example creates a single cluster in a single VPC, then configures two route
```bash
kubectl get httproute rates -o yaml
```

```
apiVersion: v1
items:
Expand Down