Minikube on Mac OS

__tmp.md

1. apply emissary-ingress

kubectl apply -f - <<EOF
---
# Source: emissary-ingress/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: emissary-ingress
  namespace: emissary
  labels:
    app.kubernetes.io/name: emissary-ingress

    app.kubernetes.io/instance: emissary-ingress
    app.kubernetes.io/part-of: emissary-ingress
    app.kubernetes.io/managed-by: getambassador.io
    product: aes
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: emissary-ingress
      app.kubernetes.io/instance: emissary-ingress
  strategy:
    type: RollingUpdate


  progressDeadlineSeconds: 600
  template:
    metadata:
      labels:
        app.kubernetes.io/name: emissary-ingress

        app.kubernetes.io/instance: emissary-ingress
        app.kubernetes.io/part-of: emissary-ingress
        app.kubernetes.io/managed-by: getambassador.io
        product: aes
        profile: main
      annotations:
        consul.hashicorp.com/connect-inject: 'false'
        sidecar.istio.io/inject: 'false'
    spec:
      terminationGracePeriodSeconds: 0
      securityContext:
        runAsUser: 8888
      restartPolicy: Always
      serviceAccountName: emissary-ingress
      volumes:
      - name: ambassador-pod-info
        downwardAPI:
          items:
          - fieldRef:
              fieldPath: metadata.labels
            path: labels
      containers:
      - name: ambassador
        image: docker.io/emissaryingress/emissary:2.1.0
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 8443
        - name: admin
          containerPort: 8877
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: AMBASSADOR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: AES_LOG_LEVEL
          value: "debug"
        - name: AMBASSADOR_DEBUG
          value: "diagd"
        securityContext:
          allowPrivilegeEscalation: false
        livenessProbe:
          httpGet:
            path: /ambassador/v0/check_alive
            port: admin
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 3
        readinessProbe:
          httpGet:
            path: /ambassador/v0/check_ready
            port: admin
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 3
        volumeMounts:
        - name: ambassador-pod-info
          mountPath: /tmp/ambassador-pod-info
          readOnly: true
        resources:
          limits:
            cpu: 1
            memory: 400Mi
          requests:
            cpu: 200m
            memory: 100Mi
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchLabels:
                  service: ambassador
              topologyKey: kubernetes.io/hostname
            weight: 100
      imagePullSecrets: []
      dnsPolicy: ClusterFirst
      hostNetwork: false
EOF

2. debug extauth

kubectl apply -f - <<EOF
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: emissary-apiext
  namespace: emissary-system
  labels:
    app.kubernetes.io/instance: emissary-apiext
    app.kubernetes.io/managed-by: kubectl_apply_-f_emissary-apiext.yaml
    app.kubernetes.io/name: emissary-apiext
    app.kubernetes.io/part-of: emissary-apiext
spec:
  selector:
    matchLabels:
      app.kubernetes.io/instance: emissary-apiext
      app.kubernetes.io/name: emissary-apiext
      app.kubernetes.io/part-of: emissary-apiext
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: emissary-apiext
        app.kubernetes.io/managed-by: kubectl_apply_-f_emissary-apiext.yaml
        app.kubernetes.io/name: emissary-apiext
        app.kubernetes.io/part-of: emissary-apiext
    spec:
      serviceAccountName: emissary-apiext
      containers:
        - name: emissary-apiext
          image: docker.io/emissaryingress/emissary:2.1.0
          imagePullPolicy: IfNotPresent
          command: [ "apiext", "emissary-apiext" ]
          ports:
            - name: http
              containerPort: 8080
            - name: https
              containerPort: 8443
          livenessProbe:
            httpGet:
              scheme: HTTP
              path: /probes/live
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 3
            failureThreshold: 3
          env:
            - name: APIEXT_LOGLEVEL
              value: "DEBUG"
EOF

A-setup.md

1. Install Minikube

brew install minikube // minikube version 1.24.0

2. Create cluster

# Make sure to setup docker use minimum memory 4096 and cpus 2
minikube start
// OR specific memory and cpu
minikube --memory 4096 --cpus 2 start

B-Troubleshooting.md

• You may face "TLS handshake timeout" error. it may cause Minikube run out of memory. Try stopping unused pods.

C-Simple Nginx.md

Simple Nginx

1. Deploy nginx

kubectl apply -f https://raw.githubusercontent.com/scriptcamp/minikube/main/nginx.yaml

2. Access Nodeport

minikube service nginx-service --url

Ref: https://devopscube.com/kubernetes-minikube-tutorial/

D-Emissary-ingress.md

Emissary Ingress

1. Create emissary

kubectl create namespace emissary && \
kubectl apply -f https://app.getambassador.io/yaml/emissary/2.1.2/emissary-crds.yaml && \
kubectl wait --timeout=90s --for=condition=available deployment emissary-apiext -n emissary-system
kubectl apply -f https://app.getambassador.io/yaml/emissary/2.1.2/emissary-emissaryns.yaml && \
kubectl -n emissary wait --for condition=available --timeout=90s deploy -lproduct=aes

2. Start by creating a Listener resource for HTTP on port 8080:

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: emissary-ingress-listener-8080
  namespace: emissary
spec:
  port: 8080
  protocol: HTTP
  securityModel: XFP
  hostBinding:
    namespace:
      from: ALL
EOF

3. Apply the YAML for the “Quote of the Moment" service.

kubectl apply -f https://app.getambassador.io/yaml/v2-docs/latest/quickstart/qotm.yaml

4. This Mapping tells Emissary-ingress to route all traffic inbound to the /backend/ path to the quote Service.

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: quote-backend
spec:
  hostname: "*"
  prefix: /backend/
  service: quote
  docs:
    path: "/.ambassador-internal/openapi-docs"
EOF

5. Expose load balance https://minikube.sigs.k8s.io/docs/handbook/accessing/#using-minikube-tunnel

minikube tunnel

6. Store the Emissary-ingress load balancer IP address

export LB_ENDPOINT=$(kubectl -n emissary get svc  emissary-ingress \
  -o "go-template={{range .status.loadBalancer.ingress}}{{or .ip .hostname}}{{end}}")

7. Test acccess

curl -i http://$LB_ENDPOINT/backend/

E-MySQL.md

Ref: https://linoxide.com/deploy-mysql-on-kubernetes/

1. Create mysql password secret

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: Secret
metadata:
  name: mysql-pass
type: Opaque
data:
  password: MTIzNA==
EOF

2. Create mysql pod // TODO use deployment

kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: k8s-mysql
  labels:
    name: lbl-k8s-mysql
spec:
  containers:
  - name: mysql
    image: mysql@sha256:9415bfb9a83752d30b6395c84dde03573eeba7b5b9c937c0e09c3e7b32c76c93
    env:
    - name: MYSQL_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysql-pass
          key: password
    - name: MYSQL_DATABASE
      value: db_data
    ports:
    - name: mysql
      containerPort: 3306
      protocol: TCP
    volumeMounts:
    - name: k8s-mysql-storage
      mountPath: /var/lib/mysql
  volumes:
  - name: k8s-mysql-storage
    emptyDir: {}
EOF

3. mapping service

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: Service
metadata:
  name: mysql-service
  labels:
    name: lbl-k8s-mysql
spec:
  ports:
  - port: 3306
  selector:
    name: lbl-k8s-mysql
  type: ClusterIP
EOF

F-Redis.md

Ref: https://phoenixnap.com/kb/kubernetes-redis

1. Create config map

kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-redis-config
data:
  redis-config: |
    maxmemory 2mb
    maxmemory-policy allkeys-lru 
EOF

2. Create pod

kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: redis
  labels:
    name: redis
spec:
  containers:
  - name: redis
    image: redis:5.0.4
    command:
      - redis-server
      - "/redis-master/redis.conf"
    env:
    - name: MASTER
      value: "true"
    ports:
    - containerPort: 6379
    resources:
      limits:
        cpu: "0.1"
    volumeMounts:
    - mountPath: /redis-master-data
      name: data
    - mountPath: /redis-master
      name: config
  volumes:
    - name: data
      emptyDir: {}
    - name: config
      configMap:
        name: test-redis-config
        items:
        - key: redis-config
          path: redis.conf
EOF

3. Mapping service

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: Service
metadata:
  name: redis-service
  labels:
    name: redis
spec:
  ports:
  - port: 6379
  selector:
    name: redis
  type: ClusterIP
EOF

G-Rabbit MQ.md

Ref: https://www.rabbitmq.com/kubernetes/operator/quickstart-operator.html

1. Install Krew plugin on kubectl https://krew.sigs.k8s.io/docs/user-guide/setup/install/

2. Install kubectl RabbitMQ plugin https://www.rabbitmq.com/kubernetes/operator/kubectl-plugin.html#install

3. Installing the Cluster Operator

kubectl rabbitmq install-cluster-operator

4. install the Local Path Provisioner (Non production)

kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml
kubectl annotate storageclass local-path storageclass.kubernetes.io/is-default-class=true

5. create the simplest RabbitMQ Cluster

kubectl apply -f https://raw.githubusercontent.com/rabbitmq/cluster-operator/main/docs/examples/hello-world/rabbitmq.yaml

5. Access The Management UI

username="$(kubectl get secret hello-world-default-user -o jsonpath='{.data.username}' | base64 --decode)"
echo "username: $username"
password="$(kubectl get secret hello-world-default-user -o jsonpath='{.data.password}' | base64 --decode)"
echo "password: $password"

kubectl port-forward "service/hello-world" 15672

# or using plugin

kubectl rabbitmq manage hello-world

H-Zipkin.md

1. Deploy Zipkin

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: TracingService
metadata:
  name: tracing
spec:
  service: "zipkin.default:9411"
  driver: zipkin
  config: {}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: zipkin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: zipkin
  template:
    metadata:
      labels:
        app: zipkin
    spec:
      containers:
        - name: zipkin
          image: openzipkin/zipkin
          env:
            # note: in-memory storage holds all data in memory, purging older data upon a span limit.
            #       you should use a proper storage in production environments
            - name: STORAGE_TYPE
              value: mem
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: zipkin
  name: zipkin
spec:
  ports:
    - port: 9411
      targetPort: 9411
  selector:
    app: zipkin
EOF

2. Restart Emissary

kubectl -n emissary rollout restart deploy

I-Circuit breaker.md

1. Create Listener

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: emissary-ingress-listener-8080
  namespace: emissary
spec:
  port: 8080
  protocol: HTTP
  securityModel: XFP
  hostBinding:
    namespace:
      from: ALL
EOF

2. Create deployment and service

kubectl apply -f - <<EOF
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: hello-world
    spec:
      containers:
      - name: backend
        image: docker.io/ibmcom/hello:latest
        ports:
        - name: http
          containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: hello-world
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8080
  selector:
    app: hello-world
EOF

3. Mapping service

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: hello-world-backend
spec:
  hostname: "*"
  prefix: /hello-world/
  service: hello-world
  circuit_breakers:
  - max_connections: 0
    max_pending_requests: 0
EOF

J-Diagnostics.md

1. Forward port

kubectl port-forward -n emissary deploy/emissary-ingress 8877

2. access diagnostics

http://localhost:8877/ambassador/v0/diag/

https://www.getambassador.io/docs/edge-stack/latest/topics/running/ambassador/#observability

K-Monitoring with Prometheus and Grafana.md

Prometheus

ref: https://www.getambassador.io/docs/emissary/latest/howtos/prometheus/ For forward internal port

minikube service -n emissary emissary-ingress-admin --url

1. Deploy the Prometheus Operator

kubectl create -f https://raw.githubusercontent.com/coreos/prometheus-operator/master/bundle.yaml

2. Deploy Prometheus by creating a Prometheus CRD

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: prometheus
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["get"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: default
EOF

3. apply Prometheus

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: Service
metadata:
  name: prometheus
spec:
  type: ClusterIP
  ports:
  - name: web
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    prometheus: prometheus
---
apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  name: prometheus
spec:
  ruleSelector:
    matchLabels:
      app: prometheus-operator
  serviceAccountName: prometheus
  serviceMonitorSelector:
    matchLabels:
      app: emissary
  resources:
    requests:
      memory: 400Mi
EOF

4. Create a ServiceMonitor

kubectl apply -f - <<EOF
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: emissary-monitor
  labels:
    app: emissary
spec:
  namespaceSelector:
    matchNames:
    - emissary
  selector:
    matchLabels:
      service: ambassador-admin
  endpoints:
  - port: ambassador-admin
EOF

Grafana

https://www.getambassador.io/docs/emissary/latest/howtos/prometheus/#grafana

1. deploy Grafana

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: grafana-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: grafana
  name: grafana
spec:
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      labels:
        app: grafana
    spec:
      securityContext:
        fsGroup: 472
        supplementalGroups:
          - 0
      containers:
        - name: grafana
          image: grafana/grafana:7.5.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 3000
              name: http-grafana
              protocol: TCP
          env:
            - name: GF_SERVER_ROOT_URL
              value: http://127.0.0.1/grafana
            - name: GRAFANA_PORT
              value: '3000'
            - name: GF_AUTH_BASIC_ENABLED
              value: 'false'
            - name: GF_AUTH_ANONYMOUS_ENABLED
              value: 'true'
            - name: GF_AUTH_ANONYMOUS_ORG_ROLE
              value: Admin
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /robots.txt
              port: 3000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 2
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 3000
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 250m
              memory: 750Mi
          volumeMounts:
            - mountPath: /var/lib/grafana
              name: grafana-pv
      volumes:
        - name: grafana-pv
          persistentVolumeClaim:
            claimName: grafana-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: grafana
spec:
  ports:
    - port: 80
      targetPort: 3000
      protocol: TCP
      targetPort: http-grafana
  selector:
    app: grafana
  sessionAffinity: None
  type: LoadBalancer
EOF

2. create a service

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: grafana
spec:
  hostname: "*"
  prefix: /grafana/
  service: grafana
EOF

L-Spring boot.md

Prerequisites

Run eval $(minikube -p minikube docker-env) ref: https://medium.com/swlh/how-to-run-locally-built-docker-images-in-kubernetes-b28fbc32cc1d

1. Create dockerfile

FROM openjdk:11-jre-slim

ARG JAR_FILE

COPY ./app.jar app.jar

EXPOSE 8080

ENTRYPOINT ["java","-jar","/app.jar", "--spring.datasource.url=jdbc:mysql://mysql-service:3306/db_data"]

2. Build spring boot app docker image that expose 8080 port

docker build -t local/my-app .

3. Create listener

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: emissary-ingress-listener-8080
  namespace: emissary
spec:
  port: 8080
  protocol: HTTP
  securityModel: XFP
  hostBinding:
    namespace:
      from: ALL
EOF

4. Create deployment and service

kubectl apply -f - <<EOF
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: backend
        image: local/my-app
        imagePullPolicy: Never
        ports:
        - name: http
          containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8080
  selector:
    app: my-app
EOF

5. mapping service

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: my-app
spec:
  hostname: "*"
  prefix: /my-app/
  service: my-app
EOF

M - Node Red.md

1. Create pod

kubectl apply -f - <<EOF
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: node-red
  name: node-red
spec:
  selector:
    matchLabels:
      app: node-red
  template:
    metadata:
      labels:
        app: node-red
    spec:
      containers:
      - name: node-red
        image: nodered/node-red
        ports:
        - containerPort: 1880
        volumeMounts:
        - mountPath: /data
          name: node-red-data
      volumes:
        - name: node-red-data
          emptyDir: {}
EOF

2. Mapping Service

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: Service
metadata:
  name: node-red
spec:
  ports:
    - port: 1880
      targetPort: 1880
  selector:
    app: node-red
EOF

N-Ratelimit-tutorial.md

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: RateLimitService
metadata:
  name: ratelimit
spec:
  domain: ambassador
  service: "example-rate-limit.default:5000"
  protocol_version: v3
---
apiVersion: v1
kind: Service
metadata:
  name: example-rate-limit
spec:
  type: ClusterIP
  selector:
    app: example-rate-limit
  ports:
  - port: 5000
    name: http-example-rate-limit
    targetPort: http-api
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-rate-limit
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: example-rate-limit
  template:
    metadata:
      labels:
        app: example-rate-limit
    spec:
      containers:
      - name: example-rate-limit
        image: datawiredev/test-ratelimit:0f13a77b4497
        imagePullPolicy: Always
        ports:
        - name: http-api
          containerPort: 5000
EOF

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: quote-backend
spec:
  hostname: "*"
  prefix: /backend/
  service: quote
  labels:
    ambassador:
      - request_label_group:
        - request_headers:
            key: x-ambassador-test-allow
            header_name: "x-ambassador-test-allow"
            omit_if_not_present: true
EOF

N-Ratelimit.md

1. Create config

kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: ratelimit-config
data:
  ratelimit-config: |
    ---
    domain: ambassador
    descriptors:
      - key: remote_address
        rate_limit:
          unit: second
          requests_per_unit: 1
      # - key: x-ambassador-test-allow
      #   value: probably
      #   rate_limit:
      #     unit: second
      #     requests_per_unit: 1
EOF

2. Create and apply ratelimit service

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: RateLimitService
metadata:
  name: ratelimit
spec:
  service: "example-rate-limit.default:8081"
  protocol_version: v3
---
apiVersion: v1
kind: Service
metadata:
  name: example-rate-limit
spec:
  type: ClusterIP
  selector:
    app: example-rate-limit
  ports:
  # - port: 8080
  #   name: http
  #   targetPort: 8080
  - port: 8081
    name: grpc
    targetPort: 8081
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-rate-limit
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: example-rate-limit
  template:
    metadata:
      labels:
        app: example-rate-limit
    spec:
      containers:
      - name: example-rate-limit
        image: envoyproxy/ratelimit:master
        imagePullPolicy: Always
        command: ["/bin/ratelimit"]
        ports:
        # - name: http
        #   containerPort: 8080
        - name: grpc
          containerPort: 8081
        volumeMounts:
        - mountPath: /data/ratelimit/config/config.yaml
          name: config
          subPath: config.yaml
        env:
        - name: USE_STATSD
          value: "false"
        - name: LOG_LEVEL
          value: "DEBUG"
        - name: REDIS_SOCKET_TYPE
          value: "tcp"
        - name: REDIS_URL
          value: "redis-service:6379"
        - name: RUNTIME_ROOT
          value: "/data"
        - name: RUNTIME_SUBDIRECTORY
          value: "ratelimit"
        - name: RUNTIME_WATCH_ROOT
          value: "false"
      volumes:
      - name: config
        configMap:
          name: ratelimit-config
          items:
          - key: ratelimit-config
            path: config.yaml
EOF

2. add label to quote-backend service

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: quote-backend
spec:
  hostname: "*"
  prefix: /backend/
  service: quote
  labels:
    ambassador:
      - request_label_group:
        - remote_address:
            key: remote_address
EOF

O-Auth service.md

1. start auth service

kubectl apply -f - <<EOF
---
apiVersion: v1
kind: Service
metadata:
  name: example-auth
spec:
  type: ClusterIP
  selector:
    app: example-auth
  ports:
  - port: 3000
    name: http-example-auth
    targetPort: http-api
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-auth
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: example-auth
  template:
    metadata:
      labels:
        app: example-auth
    spec:
      containers:
      - name: example-auth
        image: docker.io/datawire/ambassador-auth-service:2.0.0
        imagePullPolicy: Always
        ports:
        - name: http-api
          containerPort: 3000
EOF

2. apply auth service

kubectl apply -f - <<EOF
---
apiVersion: getambassador.io/v3alpha1
kind: AuthService
metadata:
  name: authentication
spec:
  auth_service: "example-auth.default:3000"
  path_prefix: "/extauth"
  allowed_request_headers:
  - "x-qotm-session"
  allowed_authorization_headers:
  - "x-qotm-session"
  # failure_mode_allow: true
EOF