Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions _blog/2017/0.1-using-network-policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ Network Policy is typically enforced at the host node, outside the network names

## Examples

Let’s walk through a few examples of what you might want to do with Kubernetes Network Policy for an Istio-enabled application. Consider the BookInfo sample application. We’re going to cover the following use cases for Network Policy:
Let’s walk through a few examples of what you might want to do with Kubernetes Network Policy for an Istio-enabled application. Consider the Bookinfo sample application. We’re going to cover the following use cases for Network Policy:

- Reduce attack surface of the application ingress
- Enforce fine-grained isolation within the application
Expand Down Expand Up @@ -102,14 +102,14 @@ spec:

### Enforce fine-grained isolation within the application

Here is the service graph for the BookInfo application.
Here is the service graph for the Bookinfo application.

{% assign url = home | append: "/docs/guides/img/bookinfo/withistio.svg" %}
{% include figure.html width='80%' ratio='59.08%'
img=url
alt='BookInfo Service Graph'
title='BookInfo Service Graph'
caption='BookInfo Service Graph'
alt='Bookinfo Service Graph'
title='Bookinfo Service Graph'
caption='Bookinfo Service Graph'
%}

This graph shows every connection that a correctly functioning application should be allowed to make. All other connections, say from the Istio Ingress directly to the Rating service, are not part of the application. Let’s lock out those extraneous connections so they cannot be used by an attacker. Imagine, for example, that the Ingress pod is compromised by an exploit that allows an attacker to run arbitrary code. If we only allow connections to the Product Page pods using Network Policy, the attacker has gained no more access to my application backends _even though they have compromised a member of the service mesh_.
Expand Down
2 changes: 1 addition & 1 deletion _blog/2017/adapter-model.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,5 +90,5 @@ The refreshed Mixer adapter model is designed to provide a flexible framework to
Handlers provide configuration data for individual adapters, templates determine exactly what kind of data different adapters want to consume at runtime, instances let operators prepare this data, rules direct the data to one or more handlers.

You can learn more about Mixer's overall architecture [here]({{home}}/docs/concepts/policy-and-control/), and learn the specifics of templates, handlers,
and rules [here]({{home}}/docs/reference/config/mixer/). You can find many examples of Mixer configuration resources in the BookInfo sample
and rules [here]({{home}}/docs/reference/config/mixer/). You can find many examples of Mixer configuration resources in the Bookinfo sample
[here](https://github.com/istio/istio/tree/master/samples/bookinfo/kube).
22 changes: 11 additions & 11 deletions _docs/guides/bookinfo.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ book, similar to a single catalog entry of an online book store. Displayed
on the page is a description of the book, book details (ISBN, number of
pages, and so on), and a few book reviews.

The BookInfo application is broken into four separate microservices:
The Bookinfo application is broken into four separate microservices:

* *productpage*. The productpage microservice calls the *details* and *reviews* microservices to populate the page.
* *details*. The details microservice contains book information.
Expand All @@ -36,9 +36,9 @@ The end-to-end architecture of the application is shown below.

{% include figure.html width='80%' ratio='68.52%'
img='./img/bookinfo/noistio.svg'
alt='BookInfo Application without Istio'
title='BookInfo Application without Istio'
caption='BookInfo Application without Istio'
alt='Bookinfo Application without Istio'
title='Bookinfo Application without Istio'
caption='Bookinfo Application without Istio'
%}

This application is polyglot, i.e., the microservices are written in different languages.
Expand All @@ -61,9 +61,9 @@ although in all cases the resulting deployment will look like this:

{% include figure.html width='80%' ratio='59.08%'
img='./img/bookinfo/withistio.svg'
alt='BookInfo Application'
title='BookInfo Application'
caption='BookInfo Application'
alt='Bookinfo Application'
title='Bookinfo Application'
caption='Bookinfo Application'
%}

All of the microservices will be packaged with an Envoy sidecar that intercepts incoming
Expand Down Expand Up @@ -220,7 +220,7 @@ To start the application, follow the instructions below corresponding to your Is

## What's next

To confirm that the BookInfo application is running, run the following `curl` command:
To confirm that the Bookinfo application is running, run the following `curl` command:

```bash
curl -o /dev/null -s -w "%{http_code}\n" http://${GATEWAY_URL}/productpage
Expand All @@ -243,7 +243,7 @@ is a good place to start for beginners.

## Cleanup

When you're finished experimenting with the BookInfo sample, you can
When you're finished experimenting with the Bookinfo sample, you can
uninstall and clean it up using the following instructions.

### Uninstall from Kubernetes environment
Expand All @@ -258,7 +258,7 @@ uninstall and clean it up using the following instructions.

```bash
istioctl get routerules #-- there should be no more routing rules
kubectl get pods #-- the BookInfo pods should be deleted
kubectl get pods #-- the Bookinfo pods should be deleted
```

### Uninstall from Docker environment
Expand All @@ -281,5 +281,5 @@ uninstall and clean it up using the following instructions.

```bash
istioctl get routerules #-- there should be no more routing rules
docker ps -a #-- the BookInfo containers should be deleted
docker ps -a #-- the Bookinfo containers should be deleted
```
8 changes: 4 additions & 4 deletions _docs/guides/integrating-vms.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@ this infrastructure as a single mesh.

{% include figure.html width='80%' ratio='56.78%'
img='./img/mesh-expansion.svg'
alt='BookInfo Application with Istio Mesh Expansion'
title='BookInfo Application with Istio Mesh Expansion'
caption='BookInfo Application with Istio Mesh Expansion'
alt='Bookinfo Application with Istio Mesh Expansion'
title='Bookinfo Application with Istio Mesh Expansion'
caption='Bookinfo Application with Istio Mesh Expansion'
%}

<!-- source of the drawing https://docs.google.com/drawings/d/1gQp1OTusiccd-JUOHktQ9RFZaqREoQbwl2Vb-P3XlRQ/edit -->
Expand All @@ -33,7 +33,7 @@ this infrastructure as a single mesh.
* Setup Istio by following the instructions in the
[Installation guide]({{home}}/docs/setup/kubernetes/quick-start.html).

* Deploy the [BookInfo]({{home}}/docs/guides/bookinfo.html) sample application (in the `bookinfo` namespace).
* Deploy the [Bookinfo]({{home}}/docs/guides/bookinfo.html) sample application (in the `bookinfo` namespace).
* Create a VM named 'vm-1' in the same project as Istio cluster, and [Join the Mesh]({{home}}/docs/setup/kubernetes/mesh-expansion.html).

## Running mysql on the VM
Expand Down
2 changes: 1 addition & 1 deletion _docs/guides/intelligent-routing.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ for a running application.

## Cleanup

When you're finished experimenting with the BookInfo sample, you can
When you're finished experimenting with the Bookinfo sample, you can
uninstall it by following the
[Bookinfo cleanup instructions]({{home}}/docs/guides/bookinfo.html#cleanup)
corresponding to your environment.
2 changes: 1 addition & 1 deletion _docs/guides/telemetry.md
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ developers to manually instrument their applications.

## Cleanup

When you're finished experimenting with the BookInfo sample, you can
When you're finished experimenting with the Bookinfo sample, you can
uninstall it by following the
[Bookinfo cleanup instructions]({{home}}/docs/guides/bookinfo.html#cleanup)
corresponding to your environment.
4 changes: 2 additions & 2 deletions _docs/setup/consul/quick-start.md
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ Quick Start instructions to install and configure Istio in a Docker Compose setu
## Deploy your application

You can now deploy your own application or one of the sample applications provided with the
installation like [BookInfo]({{home}}/docs/guides/bookinfo.html).
installation like [Bookinfo]({{home}}/docs/guides/bookinfo.html).

> Note 1: Since there is no concept of pods in a Docker setup, the Istio
> sidecar runs in the same container as the application. We will use
Expand All @@ -95,4 +95,4 @@ docker-compose -f install/consul/istio.yaml down

## What's next

* See the sample [BookInfo]({{home}}/docs/guides/bookinfo.html) application.
* See the sample [Bookinfo]({{home}}/docs/guides/bookinfo.html) application.
4 changes: 2 additions & 2 deletions _docs/setup/eureka/quick-start.md
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ Quick Start instructions to install and configure Istio in a Docker Compose setu
## Deploy your application

You can now deploy your own application or one of the sample applications provided with the
installation like [BookInfo]({{home}}/docs/guides/bookinfo.html).
installation like [Bookinfo]({{home}}/docs/guides/bookinfo.html).

> Note 1: Since there is no concept of pods in a Docker setup, the Istio
> sidecar runs in the same container as the application. We will use
Expand All @@ -88,4 +88,4 @@ docker-compose -f install/eureka/istio.yaml down

## What's next

* See the sample [BookInfo]({{home}}/docs/guides/bookinfo.html) application.
* See the sample [Bookinfo]({{home}}/docs/guides/bookinfo.html) application.
2 changes: 1 addition & 1 deletion _docs/setup/kubernetes/mesh-expansion.md
Original file line number Diff line number Diff line change
Expand Up @@ -271,4 +271,4 @@ services running on the machine.

## Putting it all together

See the [BookInfo Mesh Expansion]({{home}}/docs/guides/integrating-vms.html) guide.
See the [Bookinfo Mesh Expansion]({{home}}/docs/guides/integrating-vms.html) guide.
24 changes: 12 additions & 12 deletions _docs/setup/kubernetes/quick-start-gke-dm.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ type: markdown

Quick Start instructions to install and run Istio in [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine/) (GKE) using [Google Cloud Deployment Manager](https://cloud.google.com/deployment-manager/).

This Quick Start creates a new GKE [zonal cluster](https://cloud.google.com/kubernetes-engine/versioning-and-upgrades#versions_available_for_new_cluster_masters), installs Istio and then deploys the [BookInfo]({{home}}/docs/guides/bookinfo.html) sample
This Quick Start creates a new GKE [zonal cluster](https://cloud.google.com/kubernetes-engine/versioning-and-upgrades#versions_available_for_new_cluster_masters), installs Istio and then deploys the [Bookinfo]({{home}}/docs/guides/bookinfo.html) sample
application. It uses Deployment Manager to automate the steps detailed in the [Istio on Kubernetes setup guide]({{home}}/docs/setup/kubernetes/quick-start.html) for Kubernetes Engine


Expand Down Expand Up @@ -48,7 +48,7 @@ application. It uses Deployment Manager to automate the steps detailed in the [

We recommend that you leave the default settings as the rest of this tutorial shows how to access the installed features. By default the tool creates a
GKE alpha cluster with the specified settings, then installs the Istio [control plane]({{home}}/docs/concepts/what-is-istio/overview.html#architecture), the
[BookInfo]({{home}}/docs/guides/bookinfo.html) sample app,
[Bookinfo]({{home}}/docs/guides/bookinfo.html) sample app,
[Grafana]({{home}}/docs/tasks/telemetry/using-istio-dashboard.html) with
[Prometheus]({{home}}/docs/tasks/telemetry/querying-metrics.html),
[ServiceGraph]({{home}}/docs/tasks/telemetry/servicegraph.html),
Expand Down Expand Up @@ -111,7 +111,7 @@ deploy/zipkin 1 1 1 1 3m
```


Now confirm that the BookInfo sample application is also installed:
Now confirm that the Bookinfo sample application is also installed:


```bash
Expand All @@ -130,7 +130,7 @@ NAME HOSTS ADDRESS PORTS AGE
ing/gateway * 35.202.120.89 80 3m
```

Note down the IP and Port assigned to BookInfo product page. (in the example above, its ```35.202.120.89:80```.
Note down the IP and Port assigned to Bookinfo product page. (in the example above, its ```35.202.120.89:80```.

You can also view the installation using the ***Kubernetes Engine -> Workloads** section on the [Cloud Console](https://console.cloud.google.com/kubernetes/workload):

Expand All @@ -141,9 +141,9 @@ You can also view the installation using the ***Kubernetes Engine -> Workloads**
caption='GKE-Workloads'
%}

### Access the BookInfo sample
### Access the Bookinfo sample

1. Set up an environment variable for BookInfo's external IP address:
1. Set up an environment variable for Bookinfo's external IP address:

```bash
kubectl get ingress -o wide
Expand All @@ -152,13 +152,13 @@ You can also view the installation using the ***Kubernetes Engine -> Workloads**
export GATEWAY_URL=35.202.120.89
```

2. Verify you can access the BookInfo ```http://${GATEWAY_URL}/productpage```:
2. Verify you can access the Bookinfo ```http://${GATEWAY_URL}/productpage```:

{% include figure.html width="100%" ratio="45.04%"
img='./img/dm_bookinfo.png'
alt='BookInfo'
title='BookInfo'
caption='BookInfo'
alt='Bookinfo'
title='Bookinfo'
caption='Bookinfo'
%}

3. Now send some traffic to it:
Expand Down Expand Up @@ -225,7 +225,7 @@ Set up a tunnel to ServiceGraph:
```bash
kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=servicegraph -o jsonpath='{.items[0].metadata.name}') 8088:8088 &
```
You should see the BookInfo service topology at
You should see the Bookinfo service topology at

```
http://localhost:8088/dotviz
Expand Down Expand Up @@ -265,7 +265,7 @@ For more details on tracing see [Understanding what happened]({{home}}/docs/task

## What's next

You can further explore the BookInfo app and Istio functionality by following any of the tutorials in the
You can further explore the Bookinfo app and Istio functionality by following any of the tutorials in the
[Guides]({{home}}/docs/guides/) section. However, to do this you need to install `istioctl` to interact
with Istio. You can either [install]({{home}}/docs/setup/kubernetes/quick-start.html#installation-steps) it directly
on our workstation or within Cloud Shell.
Expand Down
6 changes: 3 additions & 3 deletions _docs/setup/kubernetes/quick-start.md
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ with UID 0 for Istio's service accounts for ingress as well the Prometheus and G
## Installation steps

Starting with the 0.2 release, Istio is installed in its own `istio-system`
namespace, and can manage micro-services from all other namespaces.
namespace, and can manage services from all other namespaces.

1. Go to the [Istio release](https://github.com/istio/istio/releases) page to download the
installation file corresponding to your OS. If you are using a MacOS or Linux system, you can also
Expand Down Expand Up @@ -162,7 +162,7 @@ istio-mixer-2104784889-20rm8 2/2 Running 0 5h
## Deploy your application

You can now deploy your own application or one of the sample applications provided with the
installation like [BookInfo]({{home}}/docs/guides/bookinfo.html).
installation like [Bookinfo]({{home}}/docs/guides/bookinfo.html).
Note: the application must use HTTP/1.1 or HTTP/2.0 protocol for all its HTTP traffic because HTTP/1.0 is not supported.

If you started the [Istio-sidecar-injector]({{home}}/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection),
Expand Down Expand Up @@ -209,6 +209,6 @@ kubectl delete -f install/kubernetes/istio-auth.yaml

## What's next

* See the sample [BookInfo]({{home}}/docs/guides/bookinfo.html) application.
* See the sample [Bookinfo]({{home}}/docs/guides/bookinfo.html) application.

* See how to [test Istio mutual TLS Authentication]({{home}}/docs/tasks/security/mutual-tls.html).
6 changes: 3 additions & 3 deletions _docs/tasks/policy-enforcement/rate-limiting.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ This task shows you how to use Istio to dynamically limit the traffic to a servi
* Setup Istio in a Kubernetes cluster by following the quick start instructions in the
[Installation guide]({{home}}/docs/setup/kubernetes/quick-start.html).

* Deploy the [BookInfo]({{home}}/docs/guides/bookinfo.html) sample application.
* Deploy the [Bookinfo]({{home}}/docs/guides/bookinfo.html) sample application.

* Initialize the application version routing to direct `reviews` service requests from
test user "jason" to version v2 and requests from any other user to v3.
Expand All @@ -36,7 +36,7 @@ Istio enables users to rate limit traffic to a service.
Consider `ratings` as an external paid service like Rotten Tomatoes® with `1qps` free quota.
Using Istio we can ensure that `1qps` is not breached.

1. Point your browser at the BookInfo `productpage` (http://$GATEWAY_URL/productpage).
1. Point your browser at the Bookinfo `productpage` (http://$GATEWAY_URL/productpage).

If you log in as user "jason", you should see black ratings stars with each review,
indicating that the `ratings` service is being called by the "v2" version of the `reviews` service.
Expand Down Expand Up @@ -192,7 +192,7 @@ If you would like the above policies enforced for a given namespace instead of t
```

* If you are not planning to explore any follow-on tasks, refer to the
[BookInfo cleanup]({{home}}/docs/guides/bookinfo.html#cleanup) instructions
[Bookinfo cleanup]({{home}}/docs/guides/bookinfo.html#cleanup) instructions
to shutdown the application.

## What's next
Expand Down
12 changes: 6 additions & 6 deletions _docs/tasks/security/basic-access-control.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ This task shows how to control access to a service using the Kubernetes labels.
* Set up Istio on Kubernetes by following the instructions in the
[Installation guide]({{home}}/docs/setup/kubernetes/).

* Deploy the [BookInfo]({{home}}/docs/guides/bookinfo.html) sample application.
* Deploy the [Bookinfo]({{home}}/docs/guides/bookinfo.html) sample application.

* Initialize the application version routing to direct `reviews` service requests from
test user "jason" to version v2 and requests from any other user to v3.
Expand All @@ -37,10 +37,10 @@ This task shows how to control access to a service using the Kubernetes labels.
Using Istio you can control access to a service based on any attributes that are available within Mixer.
This simple form of access control is based on conditionally denying requests using Mixer selectors.

Consider the [BookInfo]({{home}}/docs/guides/bookinfo.html) sample application where the `ratings` service is accessed by multiple versions
Consider the [Bookinfo]({{home}}/docs/guides/bookinfo.html) sample application where the `ratings` service is accessed by multiple versions
of the `reviews` service. We would like to cut off access to version `v3` of the `reviews` service.

1. Point your browser at the BookInfo `productpage` (http://$GATEWAY_URL/productpage).
1. Point your browser at the Bookinfo `productpage` (http://$GATEWAY_URL/productpage).

If you log in as user "jason", you should see black rating stars with each review,
indicating that the `ratings` service is being called by the "v2" version of the `reviews` service.
Expand Down Expand Up @@ -88,7 +88,7 @@ Istio also supports attribute-based whitelists and blacklists. The following whi
istioctl delete -f samples/bookinfo/kube/mixer-rule-deny-label.yaml
```

1. Verify that when you access the BookInfo `productpage` (http://$GATEWAY_URL/productpage) without logging in, you see red stars.
1. Verify that when you access the Bookinfo `productpage` (http://$GATEWAY_URL/productpage) without logging in, you see red stars.
After performing the following steps you will no longer be able to see stars unless you are logged in as "jason".

1. Create configuration for the [`list`]({{home}}/docs/reference/config/adapters/list.html)
Expand Down Expand Up @@ -151,7 +151,7 @@ Save the following YAML snippet as `checkversion-rule.yaml`:
istioctl create -f checkversion-rule.yaml
```

1. Verify that when you access the BookInfo `productpage` (http://$GATEWAY_URL/productpage) without logging in, you see **no** stars.
1. Verify that when you access the Bookinfo `productpage` (http://$GATEWAY_URL/productpage) without logging in, you see **no** stars.
Verify that after logging in as "jason" you see black stars.

## Cleanup
Expand All @@ -172,7 +172,7 @@ Verify that after logging in as "jason" you see black stars.
```

* If you are not planning to explore any follow-on tasks, refer to the
[BookInfo cleanup]({{home}}/docs/guides/bookinfo.html#cleanup) instructions
[Bookinfo cleanup]({{home}}/docs/guides/bookinfo.html#cleanup) instructions
to shutdown the application.

## What's next
Expand Down
Loading