examples: add an example of a hubble-cli Deployment #16459
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kaworu
added
kind/enhancement
maintainer-s-little-helper
bot
added
dont-merge/needs-release-note-label
kaworu
added
the
release-note/misc
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
kaworu
force-pushed
the
pr/kaworu/hubble-cli.yaml
branch
from
740999c
to
dc8bce6
Compare
qmonnet
approved these changes
Jun 7, 2021
michi-covalent
approved these changes
Jun 7, 2021
kaworu
force-pushed
the
pr/kaworu/hubble-cli.yaml
branch
from
dc8bce6
to
aefda4b
Compare
In order to debug Relay to Hubble connectivity issues, it is sometimes
useful to have a Pod running with the Hubble CLI.
Because the Relay image is based on a scratch image, kubectl exec'ing
into it is not possible. While the Hubble CLI can be found in the Cilium
Pods, the Relay certificate needed to establish the mTLS handshake to
the Hubble server is not mounted into the Cilium Pods.
This commit introduce a new hubble-cli Deployment example. When
debugging Relay mTLS issues, it can be used to quickly run a hubble-cli
Pod:
kubectl apply -n kube-system -f path/to/hubble-cli.yaml
Since the Relay mTLS certificates are mounted into the hubble-cli Pods,
one can connect to a Hubble server given it's IP address and ServerName:
kubectl exec -it -n kube-system deployment/hubble-cli -- \
hubble observe --server tls://${IP?}:4244 \
--tls-server-name ${SERVERNAME?} \
--tls-ca-cert-files /var/lib/hubble-relay/tls/hubble-server-ca.crt \
--tls-client-cert-file /var/lib/hubble-relay/tls/client.crt \
--tls-client-key-file /var/lib/hubble-relay/tls/client.key
Both ${IP} and ${SERVERNAME} can be obtained by either looking at the
Hubble Relay Pod logs or alternatively by running:
kubectl exec -it -n kube-system deployment/hubble-cli -- \
hubble watch peers --server unix:///var/run/cilium/hubble.sock
Signed-off-by: Alexandre Perrin <alex@kaworu.ch>
gandro
approved these changes
Jun 7, 2021
There was a problem hiding this comment.
Deployment itself looks good to me!
I am a bit worried about maintainability, e.g. changes to hubble-relay-client-certs, or the Hubble version getting bumped but this file getting left behind. The former is probably rare at this point, but see my inline comment for the latter.
rolinh
approved these changes
Jun 8, 2021
@gandro About the former: changing anything (even trivial) in the TLS Secrets is already difficult as one has to go through updating several repositories (certgen, cilium, and cilium-cli), I don't think it's possible without git grepping for |
This was referenced Jun 15, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
NOTE: This PR aim to replace both #14615 (which make little sense now that we don't have the auto-generated install.yaml stuff) and cilium/cilium-cli#172 (which has its own limitations with respect to Huble TLS layout changes).There is a corresponding backport PR of this targeting v1.9 at #16460.
In order to debug Relay to Hubble connectivity issues, it is sometimes useful to have a Pod running with the Hubble CLI.
Because the Relay image is based on a scratch image, kubectl exec'ing into it is not possible. While the Hubble CLI can be found in the Cilium Pods, the Relay certificate needed to establish the mTLS handshake to the Hubble server is not mounted into the Cilium Pods.
This commit introduce a new hubble-cli Deployment example. When debugging Relay mTLS issues, it can be used to quickly run a hubble-cli Pod:
Since the Relay mTLS certificates are mounted into the hubble-cli Pods, one can connect to a Hubble server given it's IP address and ServerName:
Both
${IP}and${SERVERNAME}can be obtained by either looking at the Hubble Relay Pod logs or alternatively by running: