shpwrck

Multi Cluster Service Mesh

This repository covers an opinionated approach to multicluster service mesh.

Most of the content for this proof of concept will be housed in the source repositories for specific projects.

Background

Use the right tool for the right job. Just because this is an option, doesn't mean that it is the right option!

shpwrck

Rancher 2.4.6-rc5

Architecture

• Docker install
• HA install
• rke
  • nginx-ingress
• k3s
• traefik-ingress

shpwrck

Basics

kubernetes secret basics

aquasec security analysis

The two documents above outline the basic secrets framework provided by kubernetes and its limitations. Make special note that:

• Secrets are not encrypted by default from kubernetes.
• Secrets are not reloaded upon change.

shpwrck

apiVersion: apps/v1
kind: Deployment
metadata:
  name: helloworld
  namespace: default
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:

shpwrck

LINK

The following list is sorted from general to specific.

(i.e. A listener contains a filter_chain which has either network filters or http filters...etc)

LISTENER:

What is a listener?

proto

shpwrck

apiVersion: mutations.gatekeeper.sh/v1alpha1
kind: AssignMetadata
metadata:
  name: demo-annotation-owner
spec:
  match:
    scope: Namespaced
  location: "metadata.annotations.owner"
  parameters:
    assign:

shpwrck

Ambassador CRDs

# GENERATED FILE: edits made by hand will not be preserved.
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.4.1

shpwrck

#cloud-config

# Add additional users or set the password/ssh keys for root
users:
- name: "rancher"
  passwd: "rancher"
  groups: "users"
  ssh_authorized_keys:
  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwXYZqUFZ49QQZ1gqM5oxPCCdUNBsHkTM8SbTSVfycMKYXoQpYNMyNJqTsnIToVB0gt5q3yxYaqJPWxT2H0Z3d63pgb73MbDunCQxEFNvfKPThITJPZm4IO4HTvXbJEAI2Bq1d5CEjEms2k9I9C9tyP3Nnm4EGNI3uRyZav2/02YjlNoJa9nd7z+rOgQ1BsGS4K2t9YNWij1k3X+ADAekfRq+Wy2k5kEGy+0FWgLb6MDflc8NaA31r7OJYZByce7IqEASijTBfrcGCr0n+EeZ0NYBWZg5vGNMTrqf+FfwFTz1jFH9gipz/3lsP9TvsSAk3YUmKRY/VNRvJkqCj8OdHIpTvhkM1SP2D68PBJgRW7JHiAvPd4AtkPjmBSdjp5QX1iLNONun6MKr3n+5V6dW6TGFlOhCyNh2UZg4PrZ+xpb0x41mLdXkPP4BPB51v2rMur+qLQChLBahS4ex7CRm/A4g9g0u4HoEAOml0HtWSekHWMPVBql9uWd1i8+hKrHM= jskrz@DESKTOP-H9LS01S

shpwrck

export RANCHER_SERVER_URL=<< insert server url here >>
export RANCHER_ACCESS_KEY=<< insert access key here >>
export RANCHER_SECRET_KEY=<< insert secret key here >>
export RANCHER_LOCAL_CONTEXT=<< insert local cluster context here >>

function get-kubeconfigs () {
    # Authenticate to Rancher Server
    rancher login $RANCHER_SERVER_URL --token $RANCHER_ACCESS_KEY:$RANCHER_SECRET_KEY --context $RANCHER_LOCAL_CONTEXT
    # Delete previous configs (only if Rancher is your primary Kubernetes interface)
    rm -rf ~/.kube/*

shpwrck

name: Build Video
on: push

jobs:
  create-cluster:
    runs-on: self-hosted
    steps:
      - name: Checkout Contents
        uses: actions/checkout@v2
      - name: Create Kind Cluster