The purpose of this repository is to show benefits of service mesh when running container workloads.
- Authentication and encryption
- Authorisation
- Accounting
- Record keeping
The exercises can be run on any Kubernetes cluster, though they have been only tested on
minikube.
All examples have been wrapped with a Makefile.
Tasks:
make minikube- start/create aminikubeclustermake download-istio- downloadIstioto current directory
All exercises will be based on simple bookinfo application, formed with 4 microservices.
Pods can access each other without any restrictions.
make app- deploybookinfoapplicationmake node-port- expose application on node portmake test-non-authenticated-access- deploy pod in separate namespace and test connection
Istio is deployed. Pods outside the mesh can't access pods inside the mesh.
make istio- deployIstiomake app-istio- deploy ingress gateway and destination rules (+ restart pods to inject sidecars)make test-non-authenticated-access- deploy pod in separate namespace and test connectionmake test-access- get on a productpage sidecar and curl reviews service using certificatesmake test-access-no-certs- get on a productpage sidecar and curl reviews service without a certificatemake test-identity- check identity of sidecar certificatemake test-validity- check validity of sidecar certificate
make istio-rbac- enable RBAC in default namespacemake istio-rbac-service-level- allow access to services
make kiali- openkialidashboardmake jeager- openjeagerdashboardmake grafana- opengrafanadashboardmake app-istio-break-details-service- makedetailsservice unavailable
make sleep-pod- deploy test pod in the mesh for curl requestsmake test-outbound-google- curl https://www.google.commake test-outbound-wikipedia- curl https://en.wikipedia.org/wiki/Main_Pagemake istio-block-outbound- Block all outbound traffic by defaultmake istio-allow-google- Allow only access to https://www.google.com